Fortinet PSIRTpublished Oct 13, 07:00 UTC (3d ago)ingested Oct 15, 10:23 UTC

Double free in signal handler

AI summary · grok-4.7-build

A double-free in FortiOS, FortiProxy, and FortiSwitch lets a local user crash the newcli daemon.

Fortinet PSIRT FG-IR-26-182 covers a double-free vulnerability (CWE-415) in FortiOS, FortiProxy, and FortiSwitch, rated CVSS 2.1. A locally authenticated attacker can crash the newcli daemon using crafted CLI commands. The impact is a local denial of service. The advisory was revised on 2026-10-13 and cites no CVE or in-the-wild exploitation.

CVSS 2.1 double-free (CWE-415) in FortiOS, FortiProxy, and FortiSwitch
Local authenticated attacker can crash the newcli daemon
Impact is denial of service via crafted CLI commands
No CVE or exploitation in the wild is stated

Read the original

VendorsFortinet

ProductsFortiOS FortiProxy FortiSwitch

Tags#fortinet #fortios #fortiproxy #fortiswitch #double-free #denial-of-service #cwe-415

Full article

CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on 2026-10-13 00:00:00

This source does not provide full text. Read it at fortiguard.fortinet.com.

Double free in signal handler

PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory

Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

GUI Denial of Service

September 2026 CVE Landscape

FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns