CVE-2026-59840: Buffer Over-read in Fortinet FortiOS and FortiProxy

HERMES

HERMES THREAT SCORE & MEMORY LEAK RISK

Target: Fortinet FortiOS & FortiProxy Management / Packet Daemons

Confidence: 94%

68 / 100

MEDIUM

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 13 / 20

Threat Activity 11 / 20

Weaponization 13 / 20

Exposure 15 / 20

Prevalence 19 / 20

Impact 14 / 20

Exploit Maturity 12 / 20

Attack Chain Potential 15 / 20

⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2026-59840 at HTS 68 (Medium). While not resulting in direct arbitrary code execution, buffer over-reads in perimeter gateways facilitate ASLR defeat and secret extraction during multi-stage exploitation chains.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-59840: Buffer Over-read in Fortinet FortiOS and FortiProxyVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTFortinet FortiOS Gateway

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Fortinet FortiOS Gateway documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Buffer Over-read & Information Disclosure

CVSS v3.1: 5.3 Medium / 6.5 Adjusted (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) / CWE-126: Buffer Over-read.
Disclosed in Fortinet security advisories. A buffer over-read vulnerability within data handling services allows an attacker to access memory beyond the allocated buffer, risking exposure of sensitive memory structures or crashing the target process. Addressed in FortiOS 7.6.3, 7.4.9, and 7.2.12.

Executive Summary

Fortinet reported CVE-2026-59840, an out-of-bounds read vulnerability impacting multiple versions of FortiOS and FortiProxy.

When handling specifically crafted network packets or administrative API payloads, internal buffer boundary checks fail to restrict read lengths to allocated bounds. An attacker can extract fragments of adjoining process memory (such as cryptographic session tokens or memory pointers) or induce daemon termination.

---

1. Metadata & Attack Surface

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-59840	Standardized vulnerability identifier
Vendor / Software	Fortinet / FortiOS & FortiProxy	Enterprise network security gateway
Affected Releases	FortiOS 7.6.0–7.6.2, 7.4.0–7.4.8, 7.2 (all)	Multi-version exposure
Fixed Releases	FortiOS 7.6.3, 7.4.9, 7.2.12	Official security patches
Associated CWE	CWE-126: Buffer Over-read	Out-of-bounds memory read
Impact Category	Information Disclosure / Denial of Service	Memory layout leakage

---

2. Technical Root Cause Analysis

The flaw originates from missing length validation when copying structured data packets into internal parsing buffers:

Memory Buffer Over-read Mechanism:

  Allocated Buffer [Size: 512 bytes]
  ┌────────────────────────────────────────────────────────┐
  │ Legitimate Packet Payload Data                         │
  └────────────────────────────────────────────────────────┘
  ▲                                                        ▲
  │                                                        │
  Buffer Start                                             Buffer End
                                                           │
                                                           ▼ Over-read Offset (+128 bytes)
                                                           ┌─────────────────────────┐
                                                           │ Adjoining Heap Memory   │
                                                           │ - Session keys / Ptrs   │
                                                           └─────────────────────────┘

When an offset indicator in the packet header exceeds the allocated payload segment, the processing function reads contiguous memory bytes into outgoing status responses, returning uninitialized memory blocks to the requester.

---

3. Remediation & Guidance

1. Apply Firmware Upgrade:
   Upgrade FortiOS to 7.6.3, 7.4.9, or 7.2.12 according to your production release train.
2. FortiProxy Deployments:
   Upgrade FortiProxy to 7.6.1 or 7.4.9.
3. Network Boundary Protection:
   Ensure administrative management interfaces (admin-https, admin-ssh) are not exposed to public WAN interfaces.