A vulnerability in Fortinet FortiAnalyzer and FortiManager allows an authenticated attacker to cause a system hang by sending specially crafted HTTP requests that exploit a use‑of‑potentially‑dangerous function. The flaw can lead to a denial‑of‑service condition, interrupting network visibility and policy enforcement services. The weakness is classified as CWE‑676, indicating improper handling of potentially dangerous functions that can result in software instability.

FortiAnalyzer versions 6.4, 7.0, 7.2, 7.4.0‑7.4.8, 7.6.0‑7.6.4 and FortiManager versions 6.4, 7.0, 7.2, 7.4.0‑7.4.8, 7.6.0‑7.6.4 are impacted. Verify the installed version against the affected ranges provided by Fortinet.

The CVSS score of 5.2 indicates a moderate impact. Because the issue requires authenticated access to the device, the attack vector is likely internal or remote with credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the potential for system hang warrants timely mitigation. Attackers could trigger the condition by aligning internal locks through repeated crafted requests; a single successful exploitation results in a DoS that can be critical in high‑availability environments.