← Vulnerability feed

Vulnerability record · CVE-2026-22828 · published 14 April 2026

CVE-2026-22828: Fortinet fortianalyzer cloud heap-based buffer overflow vulnerability

Fortinet · Fortianalyzer Cloud

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successful exploitation would require a large amount of effort in preparation because of ASLR and network segmentation

8.1 CVSS 3.1 High EPSS 0.90% · top 41.9% CWE-122 · Heap-based buffer overflow
8.1CVSS 3.1 base score
0.90%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successful exploitation would require a large amount of effort in preparation because of ASLR and network segmentation

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://fortiguard.fortinet.com/psirt/FG-IR-26-121 Vendor Advisory

Track CVE-2026-22828 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-47575FortiManager missing authentication allows remote code executionFortiManager and FortiManager Cloud contain a missing authentication flaw in a critical function, letting specially crafted requests execute arbitrar…KEVEPSS 95%analysed9.8CVE-2024-50563Fortinet fortianalyzer vulnerabilityA weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7…EPSS 0.58%9.8CVE-2024-48886Fortinet fortianalyzer vulnerabilityA weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy v…EPSS 0.48%9.8CVE-2024-35276Fortinet fortianalyzer stack-based buffer overflow vulnerabilityA stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 thr…EPSS 0.42%9.1CVE-2024-48884Fortinet fortimanager path traversal vulnerabilityA improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiMan…EPSS 15%8.8CVE-2024-46662Fortinet fortimanager command injection vulnerabilityA improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, FortiMan…EPSS 2.2%8.8CVE-2024-50566Fortinet fortimanager os command injection vulnerabilityA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 throu…EPSS 1.1%8.8CVE-2024-35273Fortinet fortianalyzer out-of-bounds write vulnerabilityA out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to escalation o…EPSS 0.66%

Source: NIST National Vulnerability Database (record CVE-2026-22828), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.