CVE-2025-62826

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.6.0 through 7.6.4 FortiOS versions 7.4.x FortiOS versions 7.2.x FortiProxy versions 7.6.0 through 7.6.4 FortiProxy versions 7.4.x FortiProxy versions 7.2.x

Description An improper neutralization of CRLF (Carriage Return Line Feed) sequences in HTTP headers, also known as HTTP Response Splitting, allows a remote attacker to inject arbitrary headers via crafted HTTP requests. This issue can be exploited by an attacker capable of intercepting and modifying a user's captive portal authentication request to gain unauthorized access to modify authentication requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.