CVE-2026-84392 Fortinet CVE debrief

Who should care

Defenders responsible for Fortinet FortiOS, FortiPAM, and FortiProxy systems, particularly those with authentication and web services exposed, should prioritize patching and monitoring systems for potential impacts. This includes security teams, IT administrators, and network defenders who manage these systems. Additionally, defenders should review and update incident response plans to ensure they are prepared to respond to potential security incidents.

Why it matters

CVE-2026-84392 is a NULL Pointer Dereference vulnerability in Fortinet FortiOS, FortiPAM, and FortiProxy that may allow an authenticated attacker to crash the httpsd daemon. Defenders should prioritize patching, monitoring, and restricting access to sensitive web services.

• Potential httpsd daemon crashes
• Increased monitoring and logging required
• Patching and version management necessary
• Additional authentication and authorization controls recommended

Technical summary

The vulnerability exists in Fortinet FortiOS 7.4, 7.2, and 7.0; FortiPAM 1.9.0, 1.8, 1.7, 1.6, 1.5, 1.4, 1.3, 1.2, and 1.1; and FortiProxy 7.6.0-7.6.6, 7.4, and 7.2. An authenticated attacker may crash the httpsd daemon via crafted HTTP requests. This vulnerability has a CVSS score of 2.5 and is considered low severity. However, defenders should still take action to mitigate potential risks. The vulnerability is caused by a NULL pointer dereference, which can occur when the httpsd daemon processes a crafted HTTP request.

Defensive priority

Medium priority for authentication and web service defenders

Recommended defensive actions

• Review and apply Fortinet patches for affected FortiOS, FortiPAM, and FortiProxy versions
• Monitor httpsd daemon logs for potential crashes
• Restrict access to sensitive web services
• Implement additional authentication and authorization controls
• Conduct regular vulnerability assessments and penetration testing
• Review and update incident response plans
• Verify the integrity of httpsd daemon logs

Evidence notes

The CVE record and Fortinet PSIRT advisory provide details on the vulnerability. However, there is limited information on exploitation and impact. Defenders should review these sources and monitor for potential crashes of the httpsd daemon. The CVE record was published on 2026-09-08T16:42:06.190Z and has not been modified since then. There are no known reports of exploitation in the wild, but defenders should still exercise caution and prioritize patching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.