CVE-2026-106174: Medium severity Fortinet FortiOS vulnerability
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 8.0.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Devices running FortiOS 8.0.0 or FortiOS versions 7.6.4 through 7.6.6 are affected if their HTTPS management interface is reachable by an attacker over the network.
Does exploitation require credentials or user interaction?
No. The issue can be exploited by an unauthenticated attacker with network access to the device, using crafted HTTP requests; no user interaction is indicated.
What is the expected impact of a successful attack?
A successful attack can cause a denial of service affecting the HTTPS management interface. The provided information does not indicate confidentiality or integrity impact.