CVE-2026-22627

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22627", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-01-08T06:49:28.868Z", "datePublished": "2026-03-10T16:44:12.887Z", "dateUpdated": "2026-11-06T15:42:08.430Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSwitchAXFixed", "cpes": ["cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "1.0.0", "lessThanOrEqual": "1.0.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:08.430Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-120", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSwitchAXFixed version 1.0.2 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-086", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-086"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:37:35.216423Z", "id": "CVE-2026-22627", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:37:44.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22627", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T14:37:35.216423Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:37:40.262Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSwitchAXFixed", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSwitchAXFixed version 1.0.2 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-086", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-086"}], "descriptions": [{"lang": "en", "value": "A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:08.430Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22627", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:08.430Z", "dateReserved": "2026-01-08T06:49:28.868Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-03-10T16:44:12.887Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiSwitchAXFixed", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "1.0.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiswitchaxfixed:*:*:*:*:*:*:*:*", "matchCriteriaId": "1DE31518-C416-48C9-9B35-CA73232CDBB0", "versionEndExcluding": "1.0.2", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet."}, {"lang": "es", "value": "Una vulnerabilidad de copia de b\u00fafer sin verificar el tama\u00f1o de la entrada ('desbordamiento de b\u00fafer cl\u00e1sico') en Fortinet FortiSwitchAXFixed 1.0.0 hasta 1.0.1 puede permitir a un atacante no autenticado dentro de la misma red adyacente ejecutar c\u00f3digo o comandos no autorizados en el dispositivo mediante el env\u00edo de un paquete LLDP manipulado."}], "id": "CVE-2026-22627", "lastModified": "2026-06-17T10:20:11.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22627", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T14:37:35.216423Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:12.570", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-086"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.0.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FortiSwitchAXFixed", "source": "cna", "vendor": "Fortinet"}, "product": "fortiswitchaxfixed", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-16T03:52:25.110499+00:00", "value": {"mitigation_remediation": ["Upgrade FortiSwitchAX-Chassis to version 1.0.0 or later.", "Upgrade FortiSwitchAXFixed to version 1.0.2 or later.", "If LLDP is not required for network operation, disable LLDP on the affected FortiSwitchAXFixed to prevent exploitation."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Fortinet FortiSwitchAXFixed devices running firmware versions 1.0.0 through 1.0.1 are affected. The vulnerability is not present in upgrades to FortiSwitchAX-Chassis 1.0.0 or newer, nor in FortiSwitchAXFixed 1.0.2 and later.", "description_and_impact": "A classic buffer overflow occurs in FortiSwitchAXFixed firmware when copying input without size validation, allowing an unauthenticated attacker on the same adjacent network to send a crafted LLDP packet that can lead to execution of arbitrary code or commands on the device. This flaw is classified as CWE-120, a classic buffer overflow weakness, and can compromise the confidentiality, integrity, and availability of the switch by granting full control to the attacker.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.7, indicating a high severity. Its EPSS score is less than 1%, suggesting that widespread exploitation is currently unlikely. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local: an adversary must be on the same adjacent network to craft and transmit the malicious LLDP packet. If exploited, the attacker could gain unauthorized command execution on the affected device."}}}}, "created": "2026-03-11T11:49:31.756428+00:00", "title": "Unauthenticated Buffer Overflow via LLDP Packet in FortiSwitchAXFixed", "updated": "2026-04-16T04:00:09.440760+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$fortiswitchaxfixed"]}