Back fortiguard.fortinet.com

FG IR 26 161

fortiguard.fortinet.com • August 13, 2026

A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiOS explicit proxy may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.

Disable the SOCKS proxy.

Modify the authentication scheme for the SOCKS proxy to not use Kerberos authentication in config authentication rule and config authentication scheme settings.

Virtual Patch named "FG-VD-10009617.0day." is available in FMWP db update 26.073

2026-08-12: Initial publication

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Fortinet Products Two vulnerabilities have been identified in Fortinet products affecting FortiOS and FortiWeb. The first, a stack-based buffer overflow in FortiOS explicit proxy, allows unauthenticated attackers to execute arbitrary code if Kerberos authentication and SOCKS are enabled. The second vulnerability in FortiWeb WAF permits attackers to bypass security policies through crafted requests due to an incomplete list of disallowed inputs. Both vulnerabilities were published on August 12, 2026, and have associated virtual patches available. Security professionals are advised to disable the SOCKS proxy and modify authentication schemes for FortiOS, while also applying the virtual patch for FortiWeb. No active exploitation has been reported yet, but the vulnerabilities pose significant risks if left unaddressed. 58

Extracted Entities

FG IR 26 161

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)