[ CVE-2026-106175 · Published 13 Oct 2026 ]

Vulnerability in Fortinet FortiSwitch

CVSS 2.3 EPSS <1%2 agency advisoriesFix available

[ Description ]Official description

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.

[ Fixes ]Fixes and patches

Security bulletin: Fortinet FG-IR-26-176Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-176, cited by CERT-FR CERTFR-2026-AVI-1306
Security bulletin: Fortinet FG-IR-26-177Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-177, cited by CERT-FR CERTFR-2026-AVI-1306
Security bulletin: Fortinet FG-IR-26-182Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-182, cited by CERT-FR CERTFR-2026-AVI-1306
Security bulletin: Fortinet FG-IR-26-179Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-179, cited by CERT-FR CERTFR-2026-AVI-1306
Security bulletin: Fortinet FG-IR-26-178Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-178, cited by CERT-FR CERTFR-2026-AVI-1306
Security bulletin: Fortinet FG-IR-26-185Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-185, cited by CERT-FR CERTFR-2026-AVI-1306
Security bulletin: Fortinet FG-IR-26-181Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-181, cited by CERT-FR CERTFR-2026-AVI-1306

[ Advisories ]Government CERT advisories

CERT-FR14 Oct 2026CERTFR-2026-AVI-1306

Multiple vulnerabilities in Fortinet products Translated from French

Multiple vulnerabilities have been discovered in Fortinet products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
CVE-2026-106171CVE-2026-23705CVE-2026-23706+7 more CVEs
BSI CERT-Bund13 Oct 2026WID-SEC-2026-3932

Fortinet FortiOS, FortiProxy and Fortinet FortiSwitch: Vulnerability allows denial of service Translated from German
CVE-2026-106175

[ References ]References

fortiguard.fortinet.com/psirt/FG-IR-26-182

[ Facts ]Key facts

CVE: CVE-2026-106175
EUVD: EUVD-2026-98974
Published: 13 Oct 2026, 18:17 UTC
Updated: 14 Oct 2026, 16:04 UTC
NVD status: Awaiting Analysis
CVSS 3.1: 2.3 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Scored by psirt@fortinet.com
EPSS: 0.10% chance of exploitation in 30 days · higher than <1% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-415

[ Affected ]Affected products

Fortinet FortiSwitch7.6.0 – ≤ 7.6.6, 7.4.0 – ≤ 7.4.10, 7.2.0 – ≤ 7.2.10
Fortinet FortiSASE25.4.c
Fortinet FortiPAM1.8.0 – ≤ 1.8.4, 1.7.0 – ≤ 1.7.2, 1.6.0 – ≤ 1.6.2, 1.5.0 – ≤ 1.5.1, 1.4.0 – ≤ 1.4.3, 1.3.0 – ≤ 1.3.1
Fortinet FortiOS7.6.0 – ≤ 7.6.7, 7.4.0 – ≤ 7.4.12, 7.2.0 – ≤ 7.2.13, 7.0.0 – ≤ 7.0.19
Fortinet FortiProxy7.6.0 – ≤ 7.6.6, 7.4.0 – ≤ 7.4.14, 7.2.0 – ≤ 7.2.16, 7.0.0 – ≤ 7.0.23

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Multiple vulnerabilities in Fortinet products Translated from French

Fortinet FortiOS, FortiProxy and Fortinet FortiSwitch: Vulnerability allows denial of service Translated from German

[ References ]References