Fortinet Devices Vulnerable to DoS via Double Free in Signal Handler

Fortinet has issued a security advisory detailing a critical vulnerability affecting its FortiOS, FortiProxy, and FortiSwitch products. The flaw, identified as a double free vulnerability (CWE-415) within the signal handler component, can be exploited by a local authenticated attacker.

Successful exploitation of this vulnerability allows an attacker to crash the newcli daemon, a core component responsible for command-line interface management. This crash results in a denial-of-service condition, rendering the affected devices unresponsive to CLI commands and potentially disrupting network management operations. The vulnerability has been assigned the identifier CVE-2026-106175.

The affected versions include a wide range of FortiOS releases from 7.2 through 8.0, FortiProxy versions 7.2 through 7.6, and FortiSwitch versions 7.2 through 8.0. This broad impact highlights the importance of timely patching for organizations utilizing these Fortinet products.

The vulnerability was reported to Fortinet by The UK's National Cyber Security Centre (NCSC) under a responsible disclosure program. This collaboration underscores the ongoing efforts by security researchers and national cybersecurity agencies to identify and mitigate vulnerabilities before they can be widely exploited.

Fortinet has provided a CVSSv3 score of 2.1 for this vulnerability, classifying it as low severity. While the direct impact is a denial of service, the CVSS score reflects the requirement for local authentication and the specific nature of the crash, rather than remote code execution or data compromise.

While no specific exploitation in the wild has been detailed, the nature of the vulnerability means that any authenticated user with local access could potentially trigger the crash. Organizations are strongly advised to consult Fortinet's advisory for specific upgrade paths and recommended actions to remediate this vulnerability.

This advisory serves as a reminder for administrators to maintain up-to-date firmware on their network devices and to regularly review security advisories from vendors. Proactive patching and vulnerability management are crucial for maintaining the security posture of critical network infrastructure.