CVE-2026-106175: Fortinet FortiOS

Low severity, CVSS 2.3. EPSS: 0.1% chance of exploitation in the next 30 days.

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.

Affected products

• Fortinet FortiOS: from 7.6.0, up to and including 7.6.7; from 7.4.0, up to and including 7.4.12; from 7.2.0, up to and including 7.2.13; from 7.0.0, up to and including 7.0.19
• Fortinet Fortipam: from 1.8.0, up to and including 1.8.4; from 1.7.0, up to and including 1.7.2; from 1.6.0, up to and including 1.6.2; from 1.5.0, up to and including 1.5.1; from 1.4.0, up to and including 1.4.3; from 1.3.0, up to and including 1.3.1; …
• Fortinet FortiProxy: from 7.6.0, up to and including 7.6.6; from 7.4.0, up to and including 7.4.14; from 7.2.0, up to and including 7.2.16; from 7.0.0, up to and including 7.0.23
• Fortinet Fortisase: version 25.4.c only
• Fortinet Fortiswitch: from 7.6.0, up to and including 7.6.6; from 7.4.0, up to and including 7.4.10; from 7.2.0, up to and including 7.2.10

Published 2026-10-13. Last modified 2026-10-14.