FORT Validator contains an origin‑validation error in its RRDP processing that allows a delegated certificate authority under the same Trust Anchor Locator to reference a victim CA’s public RPKI notification and snapshot URLs. When FORT downloads these URLs it incorrectly reports a successful cache hit after deleting the victim’s local snapshot, silently removing the victim’s VRPs and other signed objects from the validator’s output. This flaw can enable an attacker to hijack routes or cause loss of reachability by erasing the victim’s valid route data without immediate notice.

The vulnerability is present in all NICMx FORT‑validator releases up to and including version 1.6.7. Version 1.6.8 applies a patch that rejects cross‑origin RRDP snapshot and delta URLs. Administrators should ensure they are running 1.6.8 or later to eliminate the flaw.

The CVSS score of 7.2 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is inferred to be remote over the network, as the flaw is triggered by malicious or compromised RPKI notification and snapshot URLs that an attacker can supply. If exploited, an adversary could revoke or replace legitimate VRPs, leading to traffic hijacking or denial of service to legitimate routes.