Servers and applications
CVE-2016-6909
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.
- Severity
- Critical 9.8
- Published
- 24 Aug 2016
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 4.1.11, 4.2.13, 4.3.9
- Exploit chance
- 50% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Memory buffer errors (CWE-119)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios |
|