{"id":"CVE-2026-106174","kind":"vulnerability","aliases":["CVE-2026-106174"],"related":[],"title":"FortiOS: improper locking lets crafted HTTP requests knock out management HTTPS","description":"A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.","summary":"A locking flaw in FortiOS 8.0.0 and 7.6.4 through 7.6.6 lets an unauthenticated attacker on the network send crafted HTTP requests that hang the HTTPS management interface. The result is a denial of service against the device's admin interface, with no code execution or data access described in the sources.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","fortinet","fortios","infrastructure","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Check the running FortiOS version in the admin GUI or with `get system status` over CLI\n- Check whether HTTPS administrative access is exposed on any interface reachable from untrusted networks, with `show system global` and `show system interface`","fix":"- Move FortiOS to a fixed release after `7.6.6`, as published in the Fortinet advisory (fixed version unknown from the sources)\n- Restrict HTTPS administrative access to trusted management networks until patched","status":"open","published_at":"2026-10-27T07:16:32+00:00","first_seen_at":"2026-10-27T07:30:44+00:00","triaged_at":"2026-10-27T07:31:57+00:00","updated_at":"2026-10-27T07:31:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T07:31:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move FortiOS to a fixed release after `7.6.6`, as published in the Fortinet advisory (fixed version unknown from the sources)\n- Restrict HTTPS administrative access to trusted management networks until patched","reach":"network","title":"FortiOS: improper locking lets crafted HTTP requests knock out management HTTPS","impact":"low","summary":"A locking flaw in FortiOS 8.0.0 and 7.6.4 through 7.6.6 lets an unauthenticated attacker on the network send crafted HTTP requests that hang the HTTPS management interface. The result is a denial of service against the device's admin interface, with no code execution or data access described in the sources.","category":"infrastructure","nicknames":[],"who_cares":["fortios","fortinet","firewall","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"HTTPS management interface becomes unavailable, causing denial of service","analyst_note":"Confirm the fixed FortiOS build and whether the admin interface is exposed by default, using the Fortinet PSIRT advisory for this CVE.","how_to_check":"- Check the running FortiOS version in the admin GUI or with `get system status` over CLI\n- Check whether HTTPS administrative access is exposed on any interface reachable from untrusted networks, with `show system global` and `show system interface`","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Only FortiOS 8.0.0 and 7.6.4 through 7.6.6 are named. Devices exposing the HTTPS management interface to networks an attacker can reach are the ones that matter. Devices on other FortiOS versions or with the management interface limited to trusted networks are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":3334,"output_tokens":638,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106174':14A,17A '-2026':13A,16A '7.6.4':32B,85C '7.6.6':34B,87C '8.0.0':30B,83C 'access':71B,95C 'admin':63B 'allow':89C 'attack':38B,92C 'caus':100C 'code':67B 'craft':5A,43B,111C 'cve':12A,15A 'data':70B 'denial':56B,102C 'describ':72B 'devic':61B,98C 'execut':68B 'firewal':18B 'flaw':27B 'fortinet':19B,81C 'fortio':1A,20B,29B,82C,84C 'hang':47B 'host':24B 'http':6A,44B,112C 'https':11A,49B,107C 'improp':2A,77C 'infrastructur':21B 'interfac':51B,64B,109C 'knock':8A 'let':4A,35B 'lock':3A,26B,78C 'manag':10A,50B,108C 'may':88C 'network':41B,94C 'request':7A,45B,113C 'result':53B 'self':23B 'self-host':22B 'send':42B 'servic':58B,104C 'sourc':75B 'unauthent':37B,91C 'via':110C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Only FortiOS 8.0.0 and 7.6.4 through 7.6.6 are named. Devices exposing the HTTPS management interface to networks an attacker can reach are the ones that matter. Devices on other FortiOS versions or with the management interface limited to trusted networks are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T07:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106174","severity":null,"published_at":"2026-10-27T07:16:32+00:00","modified_at":"2026-10-27T07:16:32+00:00","first_seen_at":"2026-10-27T07:30:44+00:00","fetched_at":"2026-10-27T07:30:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}