A NULL Pointer Dereference (CWE‑476) allows an authenticated attacker to crash the httpsd daemon by sending crafted HTTP requests. The crash results in a denial of service on the affected Fortinet device. This flaw exists in Fortinet FortiOS 7.4, 7.2, 7.0, and 6.4 all versions; FortiPAM 1.9.0 and all previous 1.8 to 1.0 versions; and FortiProxy 7.6.0 through 7.6.6, 7.4 all versions, and 7.2 all versions.

FortiOS 6.4 all versions, 7.0.x (all releases from 7.0.0 through 7.0.19), 7.2.x (including 7.2.0 and 7.2.1–7.2.13 and all intermediary sub‑versions), and 7.4.x (all releases 7.4.0 through 7.4.14) are affected, as are FortiPAM 1.0.0 through 1.9.0 and all intermediate releases, and FortiProxy 7.2.0 through 7.6.6 (including all sub‑versions).

The CVSS score of 2.5 indicates low overall severity, and the EPSS score of 1% suggests that exploitation is very unlikely. The vulnerability is not listed in CISA's KEV catalog, implying no known active exploitation. The attack vector is inferred to be internal authenticated; an attacker with valid credentials must send crafted HTTP requests to trigger the crash.