VYPR
← All advisories
High severity8.1NVD Advisory· Published Dec 8, 2021· Updated Jun 17, 2026

CVE-2021-26109

CVE-2021-26109

Description

An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution.

Affected products

4
  • Fortinet/Fortios3 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=6.0.0,<=6.0.12
    • cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*
    • (no CPE)range: <7.0.1
  • Fortinet/Fortinetcpe-rescue
    Range: FortiOS before 7.0.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.