Skip to content
Back to search

CVE-2016-6909

CRITICAL
9.8NVD

Summary

generated automatically from NVD data

CVE-2016-6909, also known as EGREGIOUSBLUNDER, is a buffer overflow (CWE-119) in the Cookie parser of Fortinet FortiOS 4.x and FortiSwitch. According to the NVD description, it affects FortiOS 4.1 before 4.1.11, 4.2 before 4.2.13, 4.3 before 4.3.9, and FortiSwitch before 3.4.3. A remote attacker could send a crafted HTTP request to execute arbitrary code, and the flaw is rated CVSS 9.8 (CRITICAL, v3.0).

NVD description

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.

Share:

EPSS · FIRST.org

49.9%probability of exploitation in the next 30 days

Higher than 98% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

CVSS v3.0 Score

9.8
/ 10.0
CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published
24 août 2016
Updated
17 juin 2026
Status
Modified
Source
cve@mitre.org

Affected products

fortinet fortiosAll Fortinet FortiOS CVEs →
Versions : 4.1.11, 4.2.13, 4.3.9
fortinet fortiswitch
Versions : 3.4.2

Weaknesses (CWE)

CWE-119

References (12)

Similar CVEs

Other vulnerabilities of type CWE-119

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring