EUVD-2026-98974
GHSA-ccwm-v5qj-rgvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged CLI session on device
-
ExploitIssue crafted CLI commands
-
ExecutionTrigger double-free in newcli daemon
-
ImpactCrash management CLI service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | Exploitation requires an interactive, already-authenticated high-privilege (administrative) CLI session on the affected device - the attacker must be able to run commands against the newcli daemon and submit crafted CLI input. This is a local (AV:L) and high-privilege (PR:H) prerequisite with no user interaction, which strongly limits realistic exploitation to trusted operators or an attacker who has already gained privileged administrative access through other means. No remote, unauthenticated, or default-configuration path exists; impact is confined to a crash (denial of service) of the CLI management daemon, with no confidentiality or integrity impact. |
| Impact | This is a low-priority, low-real-risk issue despite being a named CVE. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L, base 2.3) is internally consistent with the description: exploitation requires local access and high privileges (an authenticated administrative CLI user), the only impact is a crash of the newcli daemon (availability-only, and partial - C:N/I:N), and there is no privilege escalation or code execution claimed. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. All signals agree in pointing to minimal real-world risk: an attacker who already holds high-privilege CLI access could crash a management daemon they already control, which offers little incentive. No signals conflict. The practical priority is to patch during normal maintenance cycles rather than as an emergency. |
| Exploit ScenarioDerived | A local attacker who already possesses high-privilege (administrative) CLI access to a FortiOS, FortiProxy, or FortiSwitch device issues specially crafted CLI commands that trigger a double-free in the newcli daemon, causing it to crash. No public exploit code is available, and because the attacker must already be an authenticated privileged operator, the scenario is limited to insider misuse or an already-compromised admin session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Crafted CLI commands fed to the newcli daemon on Fortinet FortiOS - and on the related FortiProxy, FortiSwitch, FortiPAM and FortiSASE platforms that share the code base - trigger a double free that crashes the daemon, giving a local, highly privileged authenticated administrator a low-impact denial of service. Exploitation requires an interactive, already-authenticated administrative CLI session, with no remote, unauthenticated or default-configuration path; no public exploit has been identified at time of analysis. At CVSS 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), this is a low-priority, low-real-risk issue despite being a named CVE.
RemediationAI
No fixed release version is provided in the available data, so consult Fortinet PSIRT advisory FG-IR-26-182 (https://fortiguard.fortinet.com/psirt/FG-IR-26-182) for the vendor's patched build on your branch and upgrade the affected FortiOS, FortiProxy, FortiSwitch, FortiPAM or FortiSASE appliance as soon as a maintenance window permits - no vendor-released patch is identified at time of analysis. Because the trigger requires an already-authenticated high-privilege CLI session (AV:L, PR:H), the most effective compensating controls reduce who can reach the CLI at all: restrict administrative access to a dedicated management VLAN or jump host and block SSH/HTTPS/console management from user-facing or internet-facing interfaces, enforce per-account RBAC so only a minimal set of operators hold super-admin rights, and require multi-factor authentication on every management account. The trade-off is operational - these controls can break remote administration workflows and require careful policy ordering to avoid locking out legitimate admins. In addition, monitor for unexpected newcli restarts or management-session drops as an indicator of attempted triggering; disabling the CLI outright is not a practical mitigation because it is the primary administrative interface, and the defect is not reachable remotely in any case.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-415 double-free defect: the newcli process - the FortiOS CLI management daemon that services console, SSH and similar administrative sessions - frees the same heap chunk twice while handling crafted CLI input, causing heap corruption and termination of the daemon. Because the bug sits in code shared across Fortinet's FortiOS-derived platforms, the CPE data lists it across fortios, fortiproxy, fortiswitch, fortipam and fortisase (cpe:2.3:a:fortinet:fortios, cpe:2.3:a:fortinet:fortiproxy, cpe:2.3:a:fortinet:fortiswitch, cpe:2.3:a:fortinet:fortipam, cpe:2.3:a:fortinet:fortisase), even though version ranges are published only for FortiOS, FortiProxy and FortiSwitch. The assessed vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L confirms a local, high-privilege, no-interaction trigger with scope unchanged and availability-only impact - no confidentiality or integrity exposure - and the platform typically restarts the CLI daemon, so the practical effect is a transient loss of management access rather than device compromise.
Know when Fortios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Requires an authenticated high-privilege local CLI session, so AV:L and PR:H; impact is only a daemon crash, so C:N/I:N/A:L with AC:L and scope unchanged.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
2DescriptionCVE.org
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated admi
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Exploit-DB