FG-IR-26-181: GUI Denial of Service

Q: Which systems are exposed to this issue?

FortiOS devices whose HTTPS management interface is reachable over the network are exposed. The issue can be triggered by an unauthenticated attacker with network access to the device.

Q: Does exploitation require valid credentials or user interaction?

No. The vulnerability is described as unauthenticated and requires neither privileges nor user interaction; an attacker sends crafted HTTP requests to the HTTPS management interface.

Q: What is the expected impact of exploitation?

Successful exploitation can deny service to the HTTPS management interface. The provided information does not indicate an impact on confidentiality or integrity.

Published Oct 13, 2026

Updated

An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

Affected Software

2 affected componentsFixes available

Fortinet FortiOS=.

Fortinet FortiOS>=7.6.4<=7.6.6

Event History

Oct 13, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

FortiOS devices whose HTTPS management interface is reachable over the network are exposed. The issue can be triggered by an unauthenticated attacker with network access to the device.

Does exploitation require valid credentials or user interaction?

No. The vulnerability is described as unauthenticated and requires neither privileges nor user interaction; an attacker sends crafted HTTP requests to the HTTPS management interface.

What is the expected impact of exploitation?

Successful exploitation can deny service to the HTTPS management interface. The provided information does not indicate an impact on confidentiality or integrity.

FG-IR-26-181: GUI Denial of Service

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

Does exploitation require valid credentials or user interaction?

What is the expected impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

Does exploitation require valid credentials or user interaction?

What is the expected impact of exploitation?