CVE-2016-6909: Fortinet FortiOS and FortiSwitch Cookie parser buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityPre-authentication remote code execution on perimeter security devices with public exploit code and a high EPSS score.

What it is

The Cookie parser in Fortinet FortiOS 4.x, 4.2.x and 4.3.x and FortiSwitch before 3.4.3 contains a buffer overflow (CWE-119) reachable through a crafted HTTP request. A remote, unauthenticated attacker can trigger it and execute arbitrary code, making it a critical pre-auth flaw on internet-facing firewall and switch management interfaces.

Impact

Successful exploitation gives the attacker arbitrary code execution on the affected device, with full loss of confidentiality, integrity and availability per the CVSS vector. On a perimeter firewall or switch this can mean full control of the device and the traffic it handles.

Attack surface

Reached over the network via HTTP requests to the affected Cookie parser; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. Any exposed management or web interface on an unpatched FortiOS or FortiSwitch build is in scope.

Exploitation

CISA KEV does not list this CVE, but public exploit code exists (Exploit-DB 40276 and a Packet Storm EGREGIOUSBLUNDER RCE writeup), and EPSS is high at roughly 0.499 (98.8th percentile). That combination indicates practical, widely available exploitation rather than a theoretical bug.

What to do

• Upgrade FortiOS to 4.1.11, 4.2.13 or 4.3.9 or later, and FortiSwitch to 3.4.3 or later, per Fortinet advisory FG-IR-16-023.
• Restrict management and web interfaces to trusted networks; do not expose them to the internet.
• Apply virtual patching or IPS signatures for the EGREGIOUSBLUNDER HTTP Cookie overflow where available.
• Rotate credentials and review device configuration for signs of tampering after any suspected exposure.
• Monitor vendor advisories for follow-up fixes if the device cannot be upgraded immediately.

Detection

• Inspect HTTP request logs for oversized or malformed Cookie headers targeting FortiOS/FortiSwitch web interfaces.
• Alert on crashes, restarts or unexpected process behavior on FortiGate/FortiSwitch devices.
• Hunt for outbound connections or new accounts/config changes originating from the device after suspicious HTTP traffic.
• Use IDS/IPS signatures matching the EGREGIOUSBLUNDER exploit and review hits against exposed management interfaces.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.