EUVD-2026-110616
GHSA-jq7m-wj67-4h5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTPS management interface over network
-
DeliverySend crafted HTTP requests
-
ExploitTrigger improper locking (CWE-667)
-
ExecutionExhaust/deadlock management service
-
ImpactDenial of service of management interface
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Proper locking
|
| Exploitation Conditions | Exploitation requires network access to the device's HTTPS management (GUI) interface, which must be reachable by the attacker, and affects FortiOS 8.0.0 and 7.6.4 through 7.6.6 specifically. Per the CVSS vector it needs no authentication and no user interaction (PR:N/UI:N) and is low-complexity (AC:L) against affected versions. The primary limiting factor is exposure of the HTTPS management interface: deployments that restrict management access to trusted administrative networks or disable HTTPS admin access on untrusted interfaces materially reduce reachability. Impact is confined to availability of the management interface (A:H; C:N/I:N), not data-plane/traffic-forwarding functions. |
| Impact | Signals are mostly consistent and point to a moderate, availability-only issue rather than a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity denial of service with no confidentiality or integrity impact - high severity only because availability loss is total. EPSS is low at 0.28% (21st percentile), and SSVC reports Exploitation: none, so there is no evidence of exploitation despite Automatable: yes and a partial Technical Impact. This is not in CISA KEV and no public exploit is identified; the vuln.today Decision label is 'this_week', indicating prioritized but not emergency remediation. The practical caveat is that the DoS targets only the HTTPS management interface, not data-plane traffic, so impact is bounded to administrative availability. Net: a genuine but availability-scoped priority - patch on a near-term (this-week) cadence, not an immediate drop-everything action, with the main risk being management-plane outage from unauthenticated network attackers who can reach the management interface. |
| Exploit ScenarioDerived | An attacker with network reachability to the FortiOS HTTPS management interface sends crafted HTTP requests that trigger an improper-locking condition (CWE-667), hanging or crashing the management service and denying administrators access to it. No authentication or user interaction is required (PR:N/UI:N), but no public exploit code is identified at time of analysis, and the precise trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Crafted HTTP requests sent to the HTTPS management (GUI) interface of FortiOS 8.0.0 and FortiOS 7.6.4 through 7.6.6 can stall that interface through improper locking, denying administrative access to the device. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the attack is remote, low-complexity, requires no authentication and no user interaction, but impact is confined to availability of the management plane (A:H; C:N/I:N) rather than traffic forwarding. Exploitation is not confirmed - SSVC records exploitation as none, EPSS is 0.28% (21st percentile) and no public exploit or PoC reference appears in the provided sources - so risk is best characterised as a moderate, exposure-dependent availability issue; the decisive factor is whether the HTTPS admin interface is reachable from untrusted networks.
RemediationAI
The provided sources do not state a fixed firmware version, so the first step is to check FortiGuard advisory FG-IR-26-181 (https://fortiguard.fortinet.com/psirt/FG-IR-26-181) for the release that resolves CVE-2026-106174 in the 7.6 and 8.0 branches and upgrade to it - patch status is not confirmed from the available data, and absence of a stated fix version is not evidence that none exists. Until a fixed build is applied, the effective control is reducing reachability of the vulnerable service: the defect only manifests against the HTTPS management (GUI) interface, so restrict administrative HTTPS access to trusted administrative networks and disable HTTPS administrative access on internet-facing or otherwise untrusted interfaces. The trade-off is that administrators lose direct remote GUI access and must go through a management network, VPN or jump host, and self-service or out-of-band GUI access from remote sites will stop working; verify alternate access before disabling the interface. Because exploitation needs no credentials, IP allow-listing on the management interface and placing the GUI on a dedicated management VDOM/interface provide the strongest reduction in exposure, while the data plane continues forwarding unaffected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-667 (Improper Locking): FortiOS's HTTPS administrative service does not correctly serialise access to a shared, lock-protected resource, and the supplied sources indicate that specially crafted HTTP requests can drive the interface into a state where it stops serving administrative sessions. The advisory does not describe the specific lock, the request pattern, or the exact code path involved, so the concrete trigger is not described in the available sources. The affected component is the management/GUI daemon rather than the data-forwarding path, which is consistent with the assessed impact of confidentiality and integrity None and availability High. The CPE cpe:2.3:a:fortinet:fortios (wildcarded, all platforms) confirms the flaw lives in FortiOS itself rather than a bundled third-party component, and the EUVD record scopes it to FortiOS 7.6.4 through 7.6.6 and 8.0.0. SSVC marks the issue Automatable: yes with Technical Impact: partial, meaning the request pattern is expected to be repeatable without per-target tuning, but the consequence is bounded to loss of management access.
Know when Fortios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote attacker can crafted-request the management interface (AV:N/AC:L/PR:N/UI:N) causing total availability loss only (A:H; C:N/I:N), scope unchanged.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
Executive ViewAI
FortiOS versions 8.0.0 and 7.6.4 through 7.6.6 are affected by a high-severity vulnerability that can allow an unauthenticated remote attacker to stall the HTTPS management interface, denying administrative access. This could disrupt IT operations and incident response capabilities, as administrators may be locked out of critical security devices. Leadership should prioritize patching and reducing exposure of management interfaces to untrusted networks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated admi
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Exploit-DB