CVE-2026-106175: Fortinet Double Free Vulnerability

CVE-2026-106175 Overview

CVE-2026-106175 is a Double Free vulnerability [CWE-415] affecting Fortinet FortiOS, FortiProxy, and FortiSwitch. The flaw resides in the newcli daemon, which processes command-line interface input. A local authenticated attacker with high privileges can craft specific CLI commands that trigger the double free condition and crash the daemon. The vulnerability affects FortiOS 7.6.0 through 7.6.7, all 7.4 and 7.2 versions, FortiProxy 7.6.0 through 7.6.6 along with all 7.4 and 7.2 versions, and FortiSwitch 7.6.0 through 7.6.6 along with all 7.4 and 7.2 versions.

Critical Impact
A local authenticated attacker with administrative privileges can crash the newcli daemon on affected Fortinet devices, causing a temporary denial of service on the CLI management plane.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions
Fortinet FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions
Fortinet FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions

Discovery Timeline

2026-10-13 - CVE CVE-2026-106175 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-106175

Vulnerability Analysis

The vulnerability exists in the newcli daemon, the component responsible for parsing and executing administrator CLI commands on Fortinet appliances. When processing certain malformed or unexpected command sequences, the daemon frees the same memory region more than once. The double free corrupts heap metadata and causes the daemon to crash. The impact is confined to availability of the CLI management interface. Confidentiality and integrity are not affected based on the vendor advisory and CVSS vector.

Exploitation requires valid authenticated access with elevated privileges on the affected device. The attack surface is local to the device management plane, meaning the attacker must already hold a privileged administrator session over SSH, serial console, or an equivalent CLI channel.

Root Cause

The root cause is a memory management defect [CWE-415] in the CLI command parser inside newcli. The daemon releases a heap allocation and later releases the same pointer again without reinitialization. On the second free() call, the allocator detects corruption or dereferences an invalid chunk header and aborts the process.

Attack Vector

An authenticated administrator issues crafted CLI commands against the device. The parser follows a code path that releases a buffer and then re-enters a cleanup routine that releases the same buffer. The newcli process terminates. No code execution has been demonstrated by the vendor. See the Fortinet Security Advisory FG-IR-26-182 for vendor-provided technical details.

Detection Methods for CVE-2026-106175

Indicators of Compromise

Unexpected termination or restart events for the newcli daemon in device system logs.
CLI session disconnects correlated with specific administrator accounts issuing uncommon command sequences.
Repeated administrator logins followed by short-lived CLI sessions and daemon respawn messages.

Detection Strategies

Forward FortiOS, FortiProxy, and FortiSwitch system logs to a central SIEM and alert on newcli crash or restart events.
Baseline normal administrator CLI activity and flag outlier command patterns issued immediately before daemon failures.
Correlate authentication logs with process termination events to identify which administrator account triggered the crash.

Monitoring Recommendations

Enable verbose system event logging on affected Fortinet appliances and ship logs to a central analytics platform.
Monitor administrator account usage for anomalous CLI command volume, source IP changes, or off-hours activity.
Track management-plane availability metrics so repeated newcli crashes trigger operational alerts.

How to Mitigate CVE-2026-106175

Immediate Actions Required

Inventory all FortiOS, FortiProxy, and FortiSwitch devices and compare installed versions against the affected ranges listed in FG-IR-26-182.
Restrict administrative CLI access to a limited management network and trusted jump hosts only.
Audit administrator accounts, remove unused accounts, and enforce multi-factor authentication for all remaining administrators.

Patch Information

Fortinet documents fixed versions in the advisory FG-IR-26-182. Administrators should upgrade FortiOS, FortiProxy, and FortiSwitch to the fixed releases specified by Fortinet for each affected branch. Devices running end-of-support branches should be migrated to a supported, fixed release.

Workarounds

Limit administrator role assignments so fewer accounts hold the privilege level required to reach the vulnerable CLI path.
Enforce trusted-host restrictions on administrator accounts so CLI access is accepted only from specific management IP addresses.
Monitor and alert on newcli daemon crashes so operations teams can respond quickly to any abuse attempts.

bash

# Configuration example: restrict administrator access to trusted management hosts
config system admin
    edit "admin"
        set trusthost1 10.0.0.0 255.255.255.0
        set trusthost2 192.168.100.10 255.255.255.255
    next
end