CVE-2026-106174
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTP
Description
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
Weakness: CWE-667
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiOS Check your version | Firewall / NGFW | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiOS
Credit
Internally discovered and reported by Addy Varma of Fortinet InfoSec team. Fortinet is also pleased to thank Oded Weissman, and clxhzg with Tu Longfeng for reporting this vulnerability under responsible disclosure.
Vendor remediation
Upgrade to FortiOS version 8.0.1 or above Upgrade to FortiOS version 7.6.7 or above