Main Vulnerability Database Vulnerabilities #VU155703

Double free in FortiSwitch and FortiProxy - CVE-2026-106175

Published: October 14, 2026

Vulnerability identifier: #VU155703

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-106175

CWE-ID: CWE-415

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a boundary error in signal handler. A local administrator can execute a specially crafted command to trigger a double free error and crash the newcli daemon.

Affected software

FortiSwitch
FortiProxy
FortiOS

How to mitigate CVE-2026-106175

Install updates from vendor's website.

FortiSwitch - update to 7.6.7
FortiProxy - update to 7.6.7
FortiOS - update to 8.0.0

External References

https://www.fortiguard.com/psirt/FG-IR-26-182

Related Security Bulletins