Double Free Vulnerability in Fortinet FortiOS and FortiProxy Products
CVE-2026-106175

2.1LOW

Key Information:

Vendor: Fortinet
Status: Fortiswitch; Fortisase; Fortipam; FortiOS
Vendor: CVE Published:; 13 October 2026

What is CVE-2026-106175?

The vulnerability allows a local authenticated attacker to exploit a Double Free condition in Fortinet's FortiOS, FortiProxy, and FortiSwitch products. This may lead to the crashing of the newcli daemon by sending specially crafted CLI commands, potentially disrupting services. Users are advised to update their systems to the latest versions to mitigate this risk.

Affected Version(s)

FortiOS 7.6.0 <= 7.6.7

FortiOS 7.4.0 <= 7.4.12

FortiOS 7.2.0 <= 7.2.13

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-182

CVSS V3.1

Score:

2.1

Severity:

LOW

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 13, 2026
Vulnerability Reserved
Oct 6, 2026

CVE-2026-106175 Data

JSON