CVE-2025-62826

score

<0.1

cvss

3.1

epss

0.4%

published

2026-07-14

kev added

—

first seen

2026-10-21

Fortinet FortiOS 7.6.0 through 7.6.4, 7.4 all versions, 7.2 all versions and FortiProxy 7.6.0 through 7.6.4, 7.4 all versions, 7.2 all versions contain an HTTP response splitting vulnerability caused by improper neutralization of CRLF sequences in HTTP headers, letting attackers intercept and modify captive portal authentication requests to inject arbitrary headers, exploit requires interception and modification of user requests.