Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
4026 articles · 143480 vulns · 36/41 feeds (7d)
← Back to list
8.3
CVE-2025-53844EXPLOITEDPATCHED
Fortinet · FortiOS

CVE-2025-53844: A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0

Description

A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected Products

VendorProductVersions
FortinetFortiOS7.6.0, 7.4.0, 7.2.0, 7.0.0, 6.4.0, 6.2.0, 6.0.0

References

  • https://fortiguard.fortinet.com/psirt/FG-IR-26-123

Related News (2 articles)

Tier C
VulDB5h ago
CVE-2025-53844 | Fortinet FortiOS up to 7.6.3 out-of-bounds write (FG-IR-26-123)
→ No new info (linked only)
Tier A
Fortinet PSIRT16h ago
Out-of-bounds access in CAPWAP daemon
→ No new info (linked only)
CVSS 3.18.3 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
7.6.4
CWECWE-787
PublishedMay 12, 2026
Last enriched6h agov2
Trending Score62
Source articles2
Independent2
Info Completeness10/14
Missing: epss, kev, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-35616EXPKEV
CVE-2026-35616: A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
Trending: 167
CRITICALCVE-2026-44277EXP
CVE-2026-44277: A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticat
Trending: 82
MEDIUMCVE-2025-53680EXP
CVE-2025-53680: An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vul
Trending: 58
MEDIUMCVE-2025-53870EXP
CVE-2025-53870: An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet
Trending: 58
CRITICALCVE-2026-26083
CVE-2026-26083: A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, Fo
Trending: 55

Pin to Dashboard

Verification

State: verified
Confidence: 0%

Vulnerability Timeline

CVE Published
May 12, 2026
Discovered by ZDM
May 12, 2026
Updated: description, affectedVersions, exploitAvailable, activelyExploited, patchAvailable
May 12, 2026
Actively Exploited
May 12, 2026
Exploit Available
May 12, 2026
Patch Available
May 12, 2026

Version History

v2
Last enriched 6h ago
v2Tier A6h ago

Updated description with details about the capwap daemon, added new affected versions, and marked the vulnerability as actively exploited with a patch available.

descriptionaffectedVersionsexploitAvailableactivelyExploitedpatchAvailable
via Fortinet PSIRT
v16h ago

Initial creation