GUI Denial of Service
Fortinet discloses a CVSS 6.7 FortiOS flaw that can crash the HTTPS management interface.
Fortinet PSIRT advisory FG-IR-26-181 reports an improper-locking vulnerability in FortiOS, scored CVSS 6.7 and mapped to CWE-667. An unauthenticated attacker with network access can send crafted HTTP requests that cause a denial of service of the HTTPS management interface. The notice was revised on 2026-10-13 and does not cite a CVE or confirmed in-the-wild exploitation.
- FortiOS management-interface flaw is rated CVSS 6.7.
- CWE-667 improper locking can be triggered remotely.
- Unauthenticated crafted HTTP requests can DoS the HTTPS GUI.
- Advisory FG-IR-26-181 does not report exploitation.
CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests. Revised on 2026-10-13 00:00:00
This source does not provide full text. Read it at fortiguard.fortinet.com.