CVE-2026-59837 Memory corruption in FortiOS
Privileged authenticated attackers can execute arbitrary code via crafted HTTP requests due to a stack-based buffer overflow in Fortinet products.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59837?
CVE-2026-59837 is a medium-severity memory corruption vulnerability in Fortinet Fortios, published on 14 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
Weakness: CWE-121
Which versions are affected by CVE-2026-59837?
It affects 3 products.
Products include Fortinet Fortios, Fortinet Fortipam, Fortinet Fortiproxy.
How do I fix CVE-2026-59837?
No fix has been published for CVE-2026-59837 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-59837 being exploited?
There is no known exploitation of CVE-2026-59837 in the wild and no public exploit code.
Other vulnerabilities in Fortinet Fortios
Sources
Also known as GHSA-wxrh-6ch6-6hp4.