PSIRT Header injection in captive portal authentication form Summary An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted HTTP requests. Version Affected Solution FortiOS 8.0 Not affected Not Applicable FortiOS 7.6 7.6.0 through 7.6.4 Upgrade to 7.6.5 or above FortiOS 7.4 7.4 all versions Migrate to a fixed release FortiOS 7.2 7.2 all versions Migrate to a fixed release FortiProxy 7.6 7.6.0 through 7.6.4 Upgrade to 7.6.5 or above FortiProxy 7.4 7.4 all versions Migrate to a fixed release FortiProxy 7.2 7.2 all versions Migrate to a fixed release Follow the recommended upgrade path using our tool at: https://docs.fortinet.com/upgrade-tool Acknowledgement Fortinet is pleased to thank Vang3lis from VARAS@IIE for reporting this vulnerability under responsible disclosure. Timeline 2026-07-14: Initial publication IR Number FG-IR-26-153 Published Date Jul 14, 2026 Component OTHERS Severity Low Discovered External Attack Type Unauthenticated Known Exploited No CVSSv3 Score 3.1 Impact Execute unauthorized code or commands CVE ID CVE-2025-62826 Download CVRF CSAF