Description
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0 – ≤ 7.6.8, 7.4.0 – ≤ 7.4.13, 7.2.0 – ≤ 7.2.14, 7.0.0 – ≤ 7.0.19 | — |
| Fortinet | FortiSwitch | 7.6.0 – ≤ 7.6.6, 7.4.0 – ≤ 7.4.10, 7.2.0 – ≤ 7.2.10 | — |
| Fortinet | FortiProxy | 7.6.0 – ≤ 7.6.6, 7.4.0 – ≤ 7.4.14, 7.2.0 – ≤ 7.2.16, 7.0.0 – ≤ 7.0.23 | — |
Advisories 3
- NCSC-2026-0479 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 11, 2026
- SSA-651988 SSA-651988: Double Free vulnerability in Fortigate NGFW before V7.6.9 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Nov 10, 2026
- WID-SEC-2026-3932 Fortinet FortiOS, FortiProxy und Fortinet FortiSwitch: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 13, 2026