OTPulse

Uncontrolled Resource Consumption in SNMP

MonitorCVSS 5.9FG-IR-26-172Sep 8, 2026
Fortinet
IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An uninitialized variable vulnerability exists in the FortiAnalyzer SNMP daemon (CWE-457). An authenticated attacker can send a specially crafted SNMP query to cause uncontrolled resource consumption, resulting in denial of service to the SNMP service. The vulnerability affects FortiAnalyzer versions 7.6.3 through 7.6.6 and has been corrected in version 7.6.7 and later.

What this means
What could happen
An authenticated attacker could trigger high memory or CPU consumption in FortiAnalyzer's SNMP service, causing it to become unresponsive and potentially disrupting log collection and centralized monitoring for your network devices.
Who's at risk
Network administrators and security teams managing Fortinet infrastructure who rely on FortiAnalyzer for centralized logging, reporting, and forensic analysis. This affects the availability of security monitoring and compliance reporting functions critical to utilities and critical infrastructure operators.
How it could be exploited
An attacker with valid credentials sends a specially crafted SNMP query to the FortiAnalyzer device on the standard SNMP port (typically 161 UDP). The uninitialized variable in the SNMP daemon causes uncontrolled resource consumption, exhausting available memory or CPU.
Prerequisites
  • Valid SNMP community string or authentication credentials
  • Network access to FortiAnalyzer on SNMP port (UDP 161)
  • Knowledge of a valid SNMP request format that triggers the vulnerability
Remotely exploitableRequires valid authentication credentialsAffects centralized monitoring system (potential availability impact to multiple managed devices)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
FortiAnalyzer7.6.3 - 7.6.67.6.7+
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict SNMP access to FortiAnalyzer by IP address using firewall rules or device ACLs—allow only trusted management networks
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate FortiAnalyzer to version 7.6.7 or later
Long-term hardening
0/1
HARDENINGDisable SNMP on FortiAnalyzer if monitoring via SNMP is not required for your operations
View full vendor advisory
API: /api/v1/advisories/bac390af-2a5a-4b49-8057-24931006d0fc

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Uncontrolled Resource Consumption in SNMP | CVSS 5.9 - OTPulse