CVE-2025-62826 in FortiOS
Summary
by MITRE • 07/14/2026
An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/14/2026
The vulnerability described represents a critical HTTP response splitting flaw that exists within multiple Fortinet FortiOS and FortiProxy versions, specifically affecting releases from 7.6.0 through 7.6.4, along with all preceding versions in the 7.4 and 7.2 series. This weakness falls squarely under CWE-113, which categorizes improper neutralization of CRLF (Carriage Return Line Feed) sequences in HTTP headers, a well-documented security vulnerability pattern that has been extensively studied in cybersecurity literature and recognized by industry standards including the OWASP Top Ten. The flaw arises from insufficient validation and sanitization of user-supplied input within HTTP header processing, allowing attackers to inject malicious CRLF sequences that can manipulate response headers.
The technical exploitation mechanism involves an attacker who can intercept and modify captive portal authentication requests, leveraging the vulnerability to inject arbitrary HTTP headers into the response stream. This occurs when the system fails to properly sanitize or escape CRLF characters that may be present in user-provided data before incorporating them into HTTP header fields. The injection capability enables attackers to manipulate the HTTP response structure, potentially allowing for session hijacking, cross-site scripting attacks, cache poisoning, or other malicious activities that can compromise the integrity and confidentiality of web communications. The vulnerability is particularly dangerous in captive portal environments where authentication flows are critical for network access control.
The operational impact of this vulnerability extends beyond simple header injection, as it provides attackers with a potential pathway to more sophisticated attacks within the targeted network infrastructure. When an attacker successfully exploits this weakness during captive portal authentication, they can manipulate the HTTP responses sent to users, potentially redirecting traffic to malicious domains, injecting malicious content, or disrupting legitimate authentication processes. The vulnerability affects both FortiOS and FortiProxy implementations, suggesting a widespread impact across Fortinet's security product portfolio and creating potential attack vectors that could be leveraged by threat actors targeting enterprise networks using these specific versions.
Organizations utilizing affected Fortinet products should prioritize immediate remediation through official firmware updates provided by Fortinet, as these releases typically contain patches addressing the CRLF injection vulnerability. Additionally, network administrators should implement strict input validation at multiple layers of their infrastructure, including perimeter devices and internal web proxies, to mitigate potential exploitation attempts. The mitigation strategy should include monitoring for suspicious HTTP header patterns and implementing network segmentation to limit the attack surface. This vulnerability aligns with ATT&CK technique T1566.002 which covers "Phishing: Spearphishing Attachment", as attackers could potentially use this weakness to manipulate captive portal authentication flows and redirect users to malicious sites. Regular security assessments and penetration testing should be conducted to verify that the patches have been properly applied and that no residual vulnerabilities exist in the network infrastructure, particularly within authentication and access control systems that may be leveraged by threat actors for privilege escalation or lateral movement within compromised networks.