OTPulse

Null Pointer Dereference in Log Report

Low RiskCVSS 2.5FG-IR-26-173Sep 8, 2026
Fortinet
IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary

A null pointer dereference vulnerability exists in the log report generation functionality of FortiOS, FortiPAM, and FortiProxy. An authenticated administrator could cause a denial of service by triggering the vulnerability when generating reports, resulting in service crash. The issue affects FortiOS versions 7.2 and 7.4, FortiPAM versions 1.7 through 1.9.0, and FortiProxy versions 7.2, 7.4, and 7.6.0 through 7.6.6.

What this means
What could happen
An authenticated administrative user could trigger a null pointer dereference when generating log reports, causing the affected service to crash and become temporarily unavailable.
Who's at risk
Network administrators and security teams managing Fortinet FortiOS, FortiPAM, and FortiProxy appliances used for network security, VPN access, and privileged account management in utilities and industrial environments.
How it could be exploited
An attacker with administrative credentials would need to access the log report functionality and trigger a specific condition in report generation. The crash would affect the availability of the security appliance or PAM service until it restarts.
Prerequisites
  • Valid administrative credentials
  • Access to the log report generation interface
  • Ability to trigger report generation with specific parameters
remotely exploitablerequires administrative authenticationcauses service availability disruptionlow exploitability (EPSS 0.3%)
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
FortiOS7.4 all versionsMigrate to fixed release
FortiOS7.2 all versionsMigrate to fixed release
FortiPAM1.9.01.9.1+
FortiPAM1.8 all versionsMigrate to fixed release
FortiPAM1.7 all versions and 7 moreMigrate to fixed release
FortiProxy7.6.0 - 7.6.67.6.7+
FortiProxy7.4 all versionsMigrate to fixed release
FortiProxy7.2 all versionsMigrate to fixed release
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

FortiPAM
HOTFIXUpdate FortiPAM to version 1.9.1 or later
FortiProxy
HOTFIXUpdate FortiProxy to version 7.6.7 or later
FortiOS
HOTFIXFor FortiOS 7.4, 7.2 and FortiPAM 1.8, 1.7 versions, migrate to a fixed release as indicated by Fortinet
Long-term hardening
0/1
HARDENINGRestrict administrative access to log report generation to authorized personnel only
View full vendor advisory
API: /api/v1/advisories/2f961fa1-6fe2-4dfc-b8f1-c75479344eca

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.