HTTP/2 Bomb CVE-2026-49975
2026-08-25T13:07:29Z•818462e0891c0eb1dca6007ad1da3eb7fd3a18e5fbc100277ca5f02f3b3e8a44
CVE-2026-43284CVE-2026-43500CVE-2026-49975Apache-HTTP-ServerFortiClientFortiManagerFortiOSFortiSandboxFortiWebFortinetLinux-kernelPSIRTSSRFWAF-evasionXSSaccess-controlauthentication-bypassbuffer-overflowcommand-injectiondenial-of-serviceinformation-disclosureremote-code-executionvulnerability
What happened
Fortinet PSIRT feed containing multiple vulnerabilities affecting Apache HTTP Server, Fortinet FortiOS and FortiProxy, FortiWeb, FortiManager, FortiClient, FortiSIEM, FortiSandbox, FortiAuthenticator, FortiPortal, FortiPAM, FortiSwitch Manager, FortiSASE, and Linux kernel components. Issues include authentication bypass, remote code execution, command injection, buffer overflows, information disclosure, denial of service, SSRF, XSS, WAF evasion, and access-control flaws. The highest-risk issues are unauthenticated OS command injection in FortiSandbox (CVSS 9.1), FortiWeb RADIUS authentication-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 818462e0891c0eb1dca6007ad1da3eb7fd3a18e5fbc100277ca5f02f3b3e8a44
- Enrichment time
- 2026-08-25T13:07:29Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.