Live › vulnerability › CVE-2026-106174
Go to dashboardA locking flaw in FortiOS 8.0.0 and 7.6.4 through 7.6.6 lets an unauthenticated attacker on the network send crafted HTTP requests that hang the HTTPS management interface. The result is a denial of service against the device's admin interface, with no code execution or data access described in the sources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 07:30 UTC. All times on this page are UTC.
Only FortiOS 8.0.0 and 7.6.4 through 7.6.6 are named. Devices exposing the HTTPS management interface to networks an attacker can reach are the ones that matter. Devices on other FortiOS versions or with the management interface limited to trusted networks are less exposed.
No product ranges from the sources yet.
get system status over CLIshow system global and show system interface7.6.6, as published in the Fortinet advisory (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-106174")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.