CVE-2026-71408

Executive Summary

CVE-2026-71408 is an unauthenticated, network-reachable denial-of-service (DoS) vulnerability in Fortinet FortiOS, classified as CWE-770 (Allocation of Resources Without Limits or Throttling). It affects FortiOS 7.2 (all versions), 7.4 (all versions), and 7.6.0 through 7.6.6, exposing internet-facing FortiGate appliances to resource-exhaustion attacks that can degrade or interrupt device operation. The vulnerability carries a CVSS 3.1 base score of 5.3 (Medium) with low availability impact only — no confidentiality or integrity impact — and, as of this writing, has no confirmed vendor patch, no public proof-of-concept, no Nuclei template, and is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical Analysis

The NVD description for CVE-2026-71408 attributes the flaw to "allocation of resources without limits or throttling," which maps directly to CWE-770. In this vulnerability class, the affected software reserves a finite resource — memory, connection/session table entries, file descriptors, or state objects — based on attacker-controllable input or event frequency, without enforcing a per-source limit, upper bound, or rate throttle. An unauthenticated remote attacker can therefore induce gradual or rapid resource accumulation until the device exhausts the resource pool and can no longer service legitimate requests.

FortiOS is the operating system powering FortiGate next-generation firewalls, which commonly sit at the network perimeter and also expose management interfaces (HTTPS-based administrative GUI/API) to trusted and, in misconfigured deployments, untrusted networks. Resource-exhaustion flaws in such appliances are typically exercised against a listening network service that performs per-connection or per-request allocation — for example, allocating memory for each new administrative session, TLS handshake state, or similar transactional object. Because the exact attack vector in the NVD record is represented by the literal placeholder text "<insert attack vector here>", the authoritative description does not disclose a specific protocol, port, or endpoint. Per the accuracy constraints of this report, we therefore describe the mechanism at the vulnerability-class level rather than fabricate implementation details; insufficient technical detail is available to name the precise triggering service.

The CVSS vector — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L — confirms that the threat model is remote (AV:N), requires no authentication (PR:N), involves no user interaction (UI:N), has no exploitation complexity barrier (AC:L), and is scope-constrained to the vulnerable component (S:U). The only impacted security property is availability, rated Low (A:L), indicating that a single successful attack degrades but may not fully destroy device functionality, or that recovery is expected to be straightforward (e.g., process restart). There is no known in-the-wild exploitation, and the EPSS score of 0.00556 (43.7th percentile) indicates that current exploitation likelihood is low.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-71408, and the NVD record does not disclose the concrete trigger, so the attack chain below is inferred strictly from the CWE-770 vulnerability class and the CVSS characteristics. All steps describe the generic mechanism.

1. Reconnaissance / target identification: An attacker uses internet-wide scanning (e.g., Shodan/Censys) to identify publicly reachable FortiGate appliances, using fingerprints such as the "FortiGate" title banner, TLS certificate subject, or distinctive HTTP response markers. The attacker then fingerprints the FortiOS version (via the administrative login page, HTTP headers, or API banner) to confirm it falls within FortiOS 7.2.x, 7.4.x, or 7.6.0–7.6.6.

2. Triggering the flaw class: The attacker establishes a large volume of network interactions with an unauthenticated listener on the device — for example, a high rate of new TCP/TLS connections or repeated requests that cause the device to allocate a resource object for each interaction. Because the vulnerable code path lacks throttling or an allocation cap, the resource pool (e.g., memory or session-table capacity) grows toward exhaustion. The attacker does not need valid credentials, consistent with PR:N.

3. Payload / execution method: At the vulnerability-class level, the "payload" is the request stream itself — there is no code injection or memory-corruption component. The attacker tunes the volume and concurrency of requests to outpace the device's cleanup/reclamation mechanisms. The effect is a sustained or sudden depletion of the resource, at which point new legitimate sessions are dropped, administrative access becomes unresponsive, or the affected subsystem restarts.

4. Post-exploitation impact: The outcome is availability loss only: firewall or management-plane interruption, dropped user sessions, and potential failover events if high-availability pairs are deployed. There is no indication of privilege escalation, data exfiltration, or remote code execution (C:I:N). An attacker gains no persistent foothold; the objective is operational disruption, extortion pressure, or degradation of the security boundary.

It is acceptable to note: no public PoC exists, and the attack chain is inferred from the vulnerability class; details such as the specific port, request syntax, and memory thresholds are not disclosed and must not be guessed.

Impact Assessment

CVE-2026-71408 has a CVSS base score of 5.3 (Medium). The impact profile is narrow and precise: C:N / I:N / A:L under a scope-unchanged, network, unauthenticated, low-complexity model. The confidentiality and integrity of FortiGate-managed traffic are not directly at risk; the business impact concentrates on availability.

For affected enterprises, the blast radius is the FortiGate device itself plus every service that depends on it. Because FortiGate appliances are commonly the enforcement point for internet egress, VPN termination, and inter-segment policy, an availability event translates into lost internet connectivity, failed remote-access VPN sessions, and an inability to administer the firewall during an incident — a particularly problematic secondary effect because the security team loses its primary visibility and enforcement tool. In high-availability (HA) clusters, resource exhaustion on one unit may trigger failover, which can cause brief connection drops but may also propagate instability to the peer if the attack continues.

Organizations running older 7.2.x or 7.4.x branches — which are typically left unpatched longer than current 7.6.x maintenance releases — face the greatest practical exposure. The low EPSS percentile (0.00556) and absence of CISA KEV listing suggest that weaponization is not yet widespread, but the pre-authentication, remote, low-complexity nature of the flaw makes it an attractive candidate for future inclusion in scanner tooling once the undisclosed attack vector becomes public.

Detection Guidance

The precise trigger for CVE-2026-71408 is not publicly documented, so the following detection content targets the observable behavioral signature of the vulnerability class: anomalous connection volume toward FortiGate management interfaces and device-side resource-exhaustion events. SOC teams should adapt the placeholder values (protected asset IPs, ports) to their environment.

Sigma Rule

title: High-Volume Connection Attempts to FortiGate Management Ports
id: 7a4b1c2d-71408-4e5f-9a0b-1c2d3e4f5a6b
status: experimental
description: >
  Detects a single source IP generating an anomalous number of TCP connections
  to FortiGate management interfaces within a short window. This is a
  behavioral indicator for CWE-770 resource-exhaustion attempts
  (potentially CVE-2026-71408), where an unauthenticated attacker floods a
  listener to exhaust device resources.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-71408
author: SOC Engineering (valtersit.com)
date: 2026/01/01
tags:
    - attack.t1499
    - attack.t1498
    - cve.2026.71408
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        dest_port:
            - 443
            - 8443
            - 10443
        dest_ip:
            - 10.0.0.1        # placeholder: FortiGate management IP(s)
    timeframe: 5m
    condition: selection | count() by src_ip > 1000
falsepositives:
    - Legitimate monitoring/backup clients that aggregate many connections
    - Misconfigured health-check or load-balancer probes
level: medium

YARA Rule

/* 
   YARA rule to hunt for artifacts referencing CVE-2026-71408 or
   FortiOS DoS tooling in collected files, emails, and PCAP extracts.
   Because no exploit payload is known, this rule targets the CVE
   identifier and related Fortinet DoS terminology for triage.
*/
rule CVE_2026_71408_FortiOS_DoS_Artifact_Hunt
{
    meta:
        author      = "SOC Engineering (valtersit.com)"
        description = "Detects text artifacts referencing CVE-2026-71408 or FortiOS denial-of-service tooling"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-71408"
        date        = "2026-01-01"
        score       = 50

    strings:
        $cve_id = "CVE-2026-71408" ascii wide nocase
        $fos    = "FortiOS" ascii wide nocase
        $fgt    = "FortiGate" ascii wide nocase
        $dos1   = "denial of service" ascii wide nocase
        $dos2   = "resource exhaustion" ascii wide nocase
        $dos3   = "CWE-770" ascii wide nocase

    condition:
        $cve_id and (1 of ($fos, $fgt) or 1 of ($dos1, $dos2)) or
        ($fos and 2 of ($dos1, $dos2, $dos3))
}

Suricata IDS Rule

# Suricata rule for behavioral detection of CVE-2026-71408 class behavior.
# Flags a single external source opening a very large number of TCP
# connections to FortiGate management ports in a short window.
# NOTE: Ports 443/8443/10443 are typical FortiGate management ports;
# adjust to match your deployed management interface configuration.

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443,10443] (
    msg:"ET DOS Potential FortiOS Resource Exhaustion (CVE-2026-71408)";
    flow:to_server;
    flags:S;
    threshold: type both, track by_src, count 1000, seconds 60;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-71408;
    reference:cve,2026-71408;
    classtype:attempted-dos;
    sid:10071408;
    rev:1;)

Elastic Detection

/*
   EQL detection for a burst of TCP connections from one source to
   FortiGate management ports. Pair this sequence with a threshold/risk
   engine (e.g., event.risk score) because EQL itself does not aggregate
   counts. Adjust destination.port to your FortiGate management ports and
   optionally constrain destination.ip to the FortiGate address.
*/
sequence by source.ip with maxspan=5m
  [network where network.transport == "tcp" and destination.port in (443, 8443, 10443)]
  [network where network.transport == "tcp" and destination.port in (443, 8443, 10443)]
  [network where network.transport == "tcp" and destination.port in (443, 8443, 10443)]
  [network where network.transport == "tcp" and destination.port in (443, 8443, 10443)]
  [network where network.transport == "tcp" and destination.port in (443, 8443, 10443)]

Splunk SPL Query

index=network (sourcetype=fortigate_traffic OR sourcetype=netflow OR sourcetype=zeek_conn)
| where dest_port IN (443, 8443, 10443)
| bucket _time span=5m
| stats count as conn_count, dc(dest_port) as ports by src_ip, _time
| where conn_count > 1000
| sort - conn_count, _time
| table _time, src_ip, conn_count, ports

Wazuh OSSEC Rule

<!--
  Wazuh rule for FortiOS resource-exhaustion events.
  Place inside the Fortinet/FortiOS rules group and adapt to your
  syslog integration (UDP 514 or agent-based log collection).
  The keyword match targets availability-related log lines emitted
  when the device detects resource pressure.
-->
<group name="fortios,">
    <rule id="100714" level="10" frequency="8" timeframe="60">
        <match>session table|resource|exhaust|denial of service|memory allocat</match>
        <same_source_ip />
        <description>FortiOS: possible resource exhaustion attempt (CVE-2026-71408) - repeated pressure events from a single source</description>
        <group>dos,fortios,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch, advisory, or fixed version has been identified from any tracked source for CVE-2026-71408 as of the time of this report. Organizations must assume all listed FortiOS branches remain vulnerable and plan accordingly.

1. Immediate mitigations (compensating controls):

   • Restrict management-plane reachability: configure FortiGate administrative access to accept connections only from trusted administrative subnets, and terminate management HTTPS behind VPN or out-of-band management networks. Remove any management interface exposed to the internet.
   • Enforce per-source rate limiting and connection limits at the network level (upstream firewall/ACL or FortiGate config firewall policies) for traffic destined to management ports (e.g., 443, 8443, 10443).
   • Disable or restrict any unused services/listeners that accept unauthenticated network input, reducing the attack surface for resource-allocation abuse.
   • Deploy the detection rules above — particularly the Suricata threshold rule and Splunk/Elastic aggregation queries — to alert on anomalous connection bursts toward FortiGate devices.

2. Patch / upgrade steps:

   • Monitor the Fortinet PSIRT advisory feed (https://www.fortiguard.com/psirt) for a security advisory or fixed firmware release referencing CVE-2026-71408.
   • When a fixed version is released, upgrade affected FortiGate units during a maintenance window, following Fortinet's upgrade path guidance (do not skip intermediate releases without vendor confirmation).
   • Until a patch exists, prioritize moving from FortiOS 7.2.x/7.4.x legacy branches to a current 7.6.x maintenance release or newer supported branch, which reduces exposure to other known issues and shortens the eventual upgrade path.

3. Long-term hardening:

   • Adopt a policy of least exposure: all network appliances should have management interfaces isolated from general traffic, with strict source-IP allowlists and MFA-protected administrative access.
   • Establish a recurring firmware maintenance cadence (quarterly or per vendor recommendation) so that security fixes are applied within days of advisory publication, not months.
   • Subscribe to CISA KEV and Fortinet PSIRT updates; re-evaluate this CVE's priority if it enters KEV or if EPSS/exploitation activity rises.
   • Maintain up-to-date network traffic baselines (connection rates, memory/session-table utilization) so that resource-exhaustion anomalies are visible to the SOC.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-71408
2. Fortinet PSIRT Advisories — https://www.fortiguard.com/psirt (monitor for forthcoming advisory)
3. CWE-770: Allocation of Resources Without Limits or Throttling — https://cwe.mitre.org/data/definitions/770.html
4. MITRE ATT&CK T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-71408 not currently listed)

Threat actor / in-the-wild status: No known threat-actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept exist for CVE-2026-71408 at the time of writing. Exploitation likelihood is assessed as low (EPSS 0.00556, 43.7th percentile), but the unauthenticated, remote, low-complexity nature of the flaw warrants defensive preparation.