CVE-2026-84391: use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via
CVE-2026-84391 key facts
- CISA KEV
- Not listed (catalogue checked )
- Highest advisory rating
- Medium
- CVSS base score
- 6.5 (Fortinet), 6.5 (Fortinet)
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C· base score 5.9, scored by fortinetAttack vector: network. Attack complexity: low. Privileges required: low. User interaction: none. Scope: unchanged. Confidentiality impact: none. Integrity impact: none. Availability impact: high.- Weakness
- CWE-457 Denial of service
- EPSS
- 0.41% chance of exploitation in the next 30 days (35th percentile). FIRST EPSS, .
- CISA SSVC
- Exploitation: none observed. Automatable: no. Technical impact: partial. CISA, .
- Vendor advisories
- 2 from Fortinet
- Assigned by
- fortinet (CNA)
- CVE record published
- Listed by VulniPulse
Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-84391; each belongs to its advisory, not to every product listed. How records are collected and checked.
Description
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via SNMP GETBULK requests.
Text from the CVE.org record (fortinet).
How do I fix CVE-2026-84391?
- Upgrade to FortiAnalyzer version 8.0.0 or above Upgrade to FortiAnalyzer version 7.6.7 or above (CVE.org record)
Vendor advisories for CVE-2026-84391
Fortinet
2 advisories- Advisory severityMedium6.5
Medium [CVE-2026-84391] use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector here>
CVE-2026-84391Source published Source updated
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service
- Affected products in this advisory
- FortiAnalyzer
- Source-reported affected versions
- FortiAnalyzer FortiAnalyzer: 7.2 through 8.0 (vendor-listed versions)
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Advisory severityMedium6.5
Medium [CVE-2026-84391] Uncontrolled Resource Consumption in SNMP
FG-IR-26-172Source published Source updated
CVSSv3 Score: 6.5 A Use of Uninitialized Variable [CWE-457] vulnerability in Fortinet FortiAnalyzer SNMP daemon may allow a remote authenticated attacker with user permission to cause a denial of service via SNMP GETBULK requests. Revised on 2026-09-08 00:00:00
- Affected products in this advisory
- FortiAnalyzer
- Source-reported affected versions
- FortiAnalyzer FortiAnalyzer: 7.2 through 8.0 (vendor-listed versions)
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
References
Timeline
- CVE record published
- First vendor advisory listed by VulniPulse
- CVE record last updated
More Fortinet advisories
CVE-2025-61625Nov 10, 2026FortiAnalyzer path traversalCVE-2025-61625Nov 10, 2026Arbitrary file write and delete in JSON APICVE-2026-126171Nov 10, 2026Improper neutralization of special elements used in a template engine in fortisocCVE-2020-12811Oct 13, 2026HTML injection in WebUICVE-2026-22828Apr 14, 2026Heap-based buffer overflow in oftpd daemonCVE-2026-24858Jan 27, 2026FortiOS: Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288]
Get an email when Fortinet publishes the next one.
See Fortinet's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Fortinet CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
