Advisoriesby IbisFortinetCVE-2026-106175
Fortinet FortiOS: double free
No fix yet
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiOS Product | >= 7.6.0, <= 7.6.8 | No fix yet |
| >= 7.4.0, <= 7.4.13 | No fix yet | |
| >= 7.2.0, <= 7.2.14 | No fix yet | |
| >= 7.0.0, <= 7.0.19 | No fix yet | |
| FortiProxy Product | >= 7.6.0, <= 7.6.6 | No fix yet |
| >= 7.4.0, <= 7.4.14 | No fix yet | |
| >= 7.2.0, <= 7.2.16 | No fix yet | |
| >= 7.0.0, <= 7.0.23 | No fix yet | |
| FortiSwitch Product | >= 7.6.0, <= 7.6.6 | No fix yet |
| >= 7.4.0, <= 7.4.10 | No fix yet | |
| >= 7.2.0, <= 7.2.10 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-415