CVE-2026-84392

LowCVSS 2.7/10Last modified Oct 29, 2026

Description

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.4.0, <= 7.4.13; >= 7.2.0, <= 7.2.14; >= 7.0.0, <= 7.0.19; >= 6.4.0, <= 6.4.16
Fortinet	FortiProxy	>= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.14; >= 7.2.0, <= 7.2.16
Fortinet	FortiPAM	1.9.0; >= 1.8.0, <= 1.8.4; >= 1.7.0, <= 1.7.2; >= 1.6.0, <= 1.6.2; >= 1.5.0, <= 1.5.1; >= 1.4.0, <= 1.4.3; >= 1.3.0, <= 1.3.1; 1.2.0; >= 1.1.0, <= 1.1.2; >= 1.0.0, <= 1.0.3
Siemens	RUGGEDCOM APE1808	< *

References

Timeline

Published: Sep 8, 2026
Last modified: Oct 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-843938.1A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.CVE-2026-843947.5fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an op CVE-2026-843957.1Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulti CVE-2026-843965.5InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-843975.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-843987.5CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network a CVE-2026-843998.8The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does CVE-2026-844003.1CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An CVE-2026-844036.2The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low En CVE-2026-844088.7QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whe CVE-2026-844097.5The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metada CVE-2026-84417.5The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX