Description
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via SNMP GETBULK requests.
Published: 2026-09-08
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability involves an uninitialized variable in Fortinet FortiAnalyzer firmware versions 7.6.3 through 7.6.6, classified as CWE-457. When an SNMP GETBULK request is processed, the uninitialized variable can cause the threat intelligence engine to crash, resulting in a denial‑of‑service for users relying on that service. The impact is limited to loss of availability for analysis functions, with no direct compromise of confidentiality or integrity.

Affected Systems

The vulnerability affects FortiAnalyzer devices running firmware versions 7.6.3, 7.6.4, 7.6.5, and 7.6.6. These are identified by the corresponding CPE entries in the CVE record. Users of FortiAnalyzer 7.6.6 and earlier versions are at risk until they upgrade to supported releases.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate severity for this issue. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly described, but the description indicates that SNMP GETBULK requests can trigger the flaw, leading to the service crash. Based on the description, it is inferred that the attack could be feasible in environments where SNMP traffic is not authenticated or isolated.

Generated by OpenCVE AI on November 6, 2026 at 18:51 UTC.

Remediation

Vendor Solution

Upgrade to FortiAnalyzer version 8.0.0 or above Upgrade to FortiAnalyzer version 7.6.7 or above

OpenCVE Recommended Actions

  • Upgrade FortiAnalyzer firmware to version 7.6.7 or newer (or any 8.0.0+ release) to eliminate the flaw.
  • After upgrading, reboot the device to ensure the new firmware initializes all variables correctly and verify that the threat intelligence engine remains stable under typical traffic volumes.
  • If an immediate upgrade is not possible, isolate the FortiAnalyzer from untrusted input sources, limit the rate of log ingestion where feasible, and monitor system logs for unexpected service restarts to detect potential exploitation attempts.

Generated by OpenCVE AI on November 6, 2026 at 18:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 19:15:00 +0000

Type Values Removed Values Added
Title Uninitialized Variable Leading to Denial of Service in FortiAnalyzer 7.6.3-7.6.6

Fri, 06 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Description A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector here> A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via SNMP GETBULK requests.

Tue, 08 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
Title Uninitialized Variable Leading to Denial of Service in FortiAnalyzer 7.6.3-7.6.6

Tue, 08 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector here>
First Time appeared Fortinet
Fortinet fortianalyzer
Weaknesses CWE-457
CPEs cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortianalyzer
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C'}

Subscriptions

Fortinet Fortianalyzer
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-11-06T15:42:18.885Z

Reserved: 2026-09-01T16:36:11.927Z

Link: CVE-2026-84391

cve-icon Vulnrichment

Updated: 2026-09-08T17:29:37.627Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-08T17:18:37.520

Modified: 2026-11-06T16:18:59.473

Link: CVE-2026-84391

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T19:00:12Z

Weaknesses
  • CWE-457

    Use of Uninitialized Variable