Search threats, CVEs… ⌘K
Back to vendor advisories
Fortinet PSIRT AdvisoriesFG-IR-26-152

Header injection in Web Filter warning page

CVSSv3 Score: 3.4 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link. Revised on 2026-07-14 00:00:00

Read the vendor bulletin Get alerts for FortiOS
3.4CVSS out of 10Low severity
Scope

What the vendor says is affected

  • FortiOS
  • FortiProxy
Timeline

When this advisory changed

  1. Published by Fortinet

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor
Covers the same product

UI DoS attack

FG-IR-26-162