CVE-2025-62826

4.3 mediumEPSS 0.4%

Medium (4.3) in fortinet. EPSS 0.4% chance of exploitation in the next 30 days.

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-113
Published: 2026-07-14
Modified: 2026-09-29
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortios
fortinet:fortiproxy

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-153
https://cert-portal.siemens.com/productcert/html/ssa-864900.html

Check your stack JSON