FortiOS 7.6.17.6.6 WAD Daemon Stack Buffer Overflow via Kerberos Proxy
CVE-2026-71407 Published on August 12, 2026

A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.

NVD

Vulnerability Analysis

CVE-2026-71407 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
LOW

Weakness Type

What is a Stack Overflow Vulnerability?

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CVE-2026-71407 has been classified to as a Stack Overflow vulnerability or weakness.


Products Associated with CVE-2026-71407

Want to know whenever a new CVE is published for Fortinet products? stack.watch will email you.

Fortinet FortiOS
 
Fortinet Fortipam
 
Fortinet FortiProxy
 

Affected Versions

Fortinet FortiOS: Fortinet FortiPAM: Fortinet FortiProxy: