Fortinet FortiAnalyzer firmware versions 7.6.3 through 7.6.6 contain a flaw where an uninitialized variable is used during operation, a weakness classified as CWE-457. The improper handling of this variable can trigger a crash in the threat intelligence engine, resulting in a denial‑of‑service condition for users relying on that service. The impact is limited to loss of availability for the analysis functions, with no direct compromise of confidentiality or integrity.

The vulnerability affects FortiAnalyzer devices running firmware versions 7.6.3, 7.6.4, 7.6.5, and 7.6.6. These are identified by the corresponding CPE entries in the CVE record. Users of FortiAnalyzer 7.6.6 and earlier versions are at risk until they upgrade to supported releases.

The CVSS score of 5.9 indicates a moderate severity for this issue. EPSS is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly described in the description; the likely scenario involves routine operation or processing of normal traffic that triggers the uninitialized variable, causing the service to crash. Because no specific prerequisites are stated, the attack could be feasible in environments where the FortiAnalyzer processes incoming logs or threat data without external authentication or isolation.