CVE-2026-106175: 
FortiOS vulnerability analysis and mitigation

CVE-2026-106175 is a Double Free vulnerability (CWE-415) in Fortinet FortiOS, FortiProxy, FortiSwitch, FortiPAM, and FortiSASE that may allow a local authenticated attacker with high privileges to crash the newcli daemon via crafted CLI commands. It was disclosed on October 13, 2026, and affects FortiOS 7.0–7.6.7, FortiProxy 7.0–7.6.6, FortiSwitch 7.2–7.6.6, FortiPAM 1.0–1.8.4, and FortiSASE 25.4.c. The vulnerability was reported externally by the UK's National Cyber Security Centre (NCSC) under responsible disclosure. It carries a CVSS v3.1 base score of 2.3 (Low) (FortiGuard Advisory, GitHub Advisory).

The vulnerability is classified as CWE-415 (Double Free), occurring in the newcli daemon's signal handler within the CLI processing component of affected Fortinet products. A double free condition arises when the same memory address is freed more than once, which can corrupt the heap and cause the daemon to crash. Exploitation requires local access and high-level (administrative) privileges, meaning an attacker must already be authenticated on the device and able to issue CLI commands. No public proof-of-concept or technical write-up detailing the specific CLI commands or code path has been published (FortiGuard Advisory, GitHub Advisory).

Successful exploitation results in a denial-of-service condition limited to crashing the newcli daemon on the affected device, causing service unavailability for CLI-based management. There is no impact on confidentiality or integrity, and the scope is unchanged, meaning the vulnerability cannot be leveraged to affect other system components or enable lateral movement. The practical risk is low, as exploitation requires an already-authenticated, high-privileged local attacker (FortiGuard Advisory).

There is no evidence of in-the-wild exploitation, and no public proof-of-concept has been published as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score is 0.0, reflecting negligible exploitation probability. Fortinet's advisory confirms the vulnerability is not known to have been exploited (FortiGuard Advisory, GitHub Advisory).

Fortinet has released patches for all affected product lines. Recommended upgrades are: FortiOS to 7.6.9 or later (for 7.6.x), or migration to a fixed release for 7.4.x and 7.2.x; FortiProxy to 7.6.7 or later, or migration for 7.4.x and 7.2.x; FortiSwitch to 7.6.7 or later, 7.4.11 or later, or 7.2.11 or later; FortiPAM to versions 1.0.4, 1.1.3, 1.2.1, 1.3.2, 1.4.4, 1.5.2, 1.6.3, 1.7.3, or 1.8.5 or later. As a workaround, organizations should restrict CLI access to trusted administrators only and monitor for unusual CLI command patterns. The recommended upgrade path tool is available at https://docs.fortinet.com/upgrade-tool (FortiGuard Advisory).

The vulnerability was reported to Fortinet by the UK's National Cyber Security Centre (NCSC) under responsible disclosure, which Fortinet acknowledged in its advisory. Given the low CVSS score and limited impact, there has been no notable broader community or media reaction beyond standard vulnerability tracking (FortiGuard Advisory).