Vulnerability in Fortinet FortiOS

[ Description ]Official description

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

[ Fixes ]Fixes and patches

• Security bulletin: Fortinet FG-IR-26-176Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-176, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-177Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-177, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-182Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-182, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-179Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-179, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-178Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-178, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-185Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-185, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-181Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-181, cited by CERT-FR CERTFR-2026-AVI-1306

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1306

  Multiple vulnerabilities in Fortinet products Translated from French

  Multiple vulnerabilities have been discovered in Fortinet products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-106171CVE-2026-23705CVE-2026-23706+7 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3933

  Fortinet FortiOS: Vulnerability allows denial of service Translated from German

  CVE-2026-106174

[ References ]References

• fortiguard.fortinet.com/psirt/FG-IR-26-181