{"id":"CVE-2026-84392","title":"A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.…","summary":"A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-476"],"vendor":"Fortinet","product":"FortiOS","affected":["FortiOS >= 7.4.0 <= 7.4.12","FortiOS >= 7.2.0 <= 7.2.13","FortiOS >= 7.0.0 <= 7.0.19","FortiOS >= 6.4.0 <= 6.4.16","FortiProxy >= 7.6.0 <= 7.6.6","FortiProxy >= 7.4.0 <= 7.4.14","FortiProxy >= 7.2.0 <= 7.2.16","FortiPAM 1.9.0","FortiPAM >= 1.8.0 <= 1.8.4","FortiPAM >= 1.7.0 <= 1.7.2","FortiPAM >= 1.6.0 <= 1.6.2","FortiPAM >= 1.5.0 <= 1.5.1","FortiPAM >= 1.4.0 <= 1.4.3","FortiPAM >= 1.3.0 <= 1.3.1","FortiPAM 1.2.0","FortiPAM >= 1.1.0 <= 1.1.2","FortiPAM >= 1.0.0 <= 1.0.3"],"published":"2026-09-08","updated":"2026-09-08","sourceUpdated":"2026-09-08T18:35:10.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84392","references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-173","label":"psirt@fortinet.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T17:28:19.717770Z"},"scores":{"nvd":2.7,"cna":2.5},"ingestedAt":"2026-09-08T19:08:49.602Z","epss":0.00281,"epssPercentile":0.20813,"slug":"CVE-2026-84392","body":"## Overview\n\nA NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5588,"id":"CVE-2026-84392","ts":1788890890939,"field":"cvss","old":"2.5","new":"2.7"}]}