Low 1 vendor · 2 advisories

CVE-2026-84392: NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests

CVE-2026-84392 key facts

CISA KEV: Not listed (catalogue checked Nov 11, 2026)
Highest advisory rating: Low
CVSS base score: 2.7 (Fortinet), 2.5 (Fortinet)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C · base score 2.5, scored by fortinetAttack vector: network. Attack complexity: low. Privileges required: high. User interaction: none. Scope: unchanged. Confidentiality impact: none. Integrity impact: none. Availability impact: low.
Weakness: CWE-476 Denial of service
EPSS: 1.07% chance of exploitation in the next 30 days (65th percentile). FIRST EPSS, Nov 10, 2026.
CISA SSVC: Exploitation: none observed. Automatable: no. Technical impact: partial. CISA, Sep 8, 2026.
Vendor advisories: 2 from Fortinet
Assigned by: fortinet (CNA)
CVE record published: Sep 8, 2026
Listed by VulniPulse: Sep 8, 2026

Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-84392; each belongs to its advisory, not to every product listed. How records are collected and checked.

Description

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.

Text from the CVE.org record (fortinet).

How do I fix CVE-2026-84392?

Upgrade to FortiProxy version 7.6.7 or above Upgrade to FortiPAM version 1.9.1 or above Upgrade to FortiOS version 7.6.0 or above (CVE.org record)

Vendor advisories for CVE-2026-84392

Fortinet

2 advisories

Advisory severityLow2.7
Low [CVE-2026-84392] NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests
CVE-2026-84392Source published Sep 8, 2026Source updated Sep 8, 2026
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
Affected products in this advisory
FortiOS
FortiPAM
FortiProxy
Source-reported affected versions
FortiOS FortiOS: 7.2 through 8.0 (vendor-listed versions)
FortiPAM FortiPAM: 1.0 through 1.9 (vendor-listed versions)
FortiProxy FortiProxy: 7.2 through 7.6 (vendor-listed versions)
Source-reported fixed versions
No fixed-version detail extracted. This does not mean no fix exists.
Mitigation guidance
No mitigation guidance extracted; consult the source.
Full advisory and evidence Open source bulletin
Advisory severityLow2.5
Low [CVE-2026-84392] Null Pointer Dereference in Log Report
FG-IR-26-173Source published Sep 8, 2026Source updated Sep 8, 2026
CVSSv3 Score: 2.5 A NULL Pointer Dereference vulnerability [CWE-476] in FortiOS, FortiProxy and FortiPAM may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. Revised on 2026-09-08 00:00:00
Affected products in this advisory
FortiOS
FortiPAM
FortiProxy
Source-reported affected versions
FortiOS FortiOS: 7.2 through 8.0 (vendor-listed versions)
FortiPAM FortiPAM: 1.0 through 1.9 (vendor-listed versions)
FortiProxy FortiProxy: 7.2 through 7.6 (vendor-listed versions)
Source-reported fixed versions
No fixed-version detail extracted. This does not mean no fix exists.
Mitigation guidance
No mitigation guidance extracted; consult the source.
Full advisory and evidence Open source bulletin

References

Timeline

Sep 8, 2026CVE record published
Sep 8, 2026First vendor advisory listed by VulniPulse
Oct 29, 2026CVE record last updated

All Fortinet advisories

Get an email when Fortinet publishes the next one.

See Fortinet's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Fortinet

iPhone and Android apps · New on the App Store

Monitor future Fortinet CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts on Android See app features