CVE WatchSep 8, 2026

CVE-2026-84392

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.

CVSS

2.7

Low

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-476

EPSS · 30d

Not enough EPSS history yet.

Technical description

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.

Official references

fortiguard.fortinet.comhttps://fortiguard.fortinet.com/psirt/FG-IR-26-173

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-779018.8 HIG

—

———Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.4h CVE-2026-774897.8 HIG

—

———Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally.4h CVE-2026-729497.5 HIG

—

———Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.4h CVE-2026-729396.5 MED

—

———Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network.4h CVE-2026-705755.3 MED

—

———Null pointer dereference in Windows Schannel allows an authorized attacker to deny service over a network.4h CVE-2026-698817.5 HIG

—

———Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.4h