CVE-2025-62826

Severity CVSS v4.0:

Pending analysis

Type:

CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Publication date:

14/07/2026

Last modified:

11/08/2026

Description

An Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Response Splitting&#39;) vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user&#39;s captive portal authentication request to inject arbitrary headers via crafted HTTP requests.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 3.10 LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): Low
Availability (A): None

Base Score 3.x

3.10

Severity 3.x

LOW

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:fortinet:fortiproxy::::::::	7.2.0 (including)	7.6.5 (excluding)
cpe:2.3:o:fortinet:fortios::::::::	7.2.0 (including)	7.6.5 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2025-62826

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools