Key points
- FortiOS, FortiProxy and FortiSwitch are affected by a double free vulnerability in the signal handler.
- The flaw allows a local authenticated attacker to crash the newcli daemon using crafted commands.
- FortiGuard PSIRT revised the advisory on October 13, 2026, assigning a CVSS score of 2.1.
Fortinet has revised its security advisory for a vulnerability affecting FortiOS, FortiProxy and FortiSwitch. The issue is a double free error within the signal handler component. According to the official advisory from FortiGuard PSIRT, this flaw is rated with a CVSSv3 score of 2.1. This places the severity in the low range. The advisory was updated on October 13, 2026. No patch or update has been confirmed as available in the source material.
In plain English
A double free vulnerability occurs when software attempts to release memory that has already been freed. This can cause the application to behave unpredictably or crash. In this case, the flaw is in the newcli daemon. An attacker who has already authenticated locally can exploit this by sending specially crafted command line interface commands. The result is a crash of the daemon. This disrupts the command line functionality but does not necessarily grant remote access or data theft.
The background
Fortinet identified this issue in its network security products. The vulnerability is classified under CWE-415, which covers double free errors. The advisory references incident ID FG-IR-26-182. The revision on October 13, 2026, likely clarifies the scope or impact, though the core technical details remain consistent. The low CVSS score reflects the requirement for local authentication and the limited impact of a daemon crash.
What changes now
Administrators must review their FortiOS, FortiProxy and FortiSwitch environments for exposure. Since no fix is confirmed, teams should monitor for unusual daemon crashes or CLI unresponsiveness. The low severity suggests that immediate widespread disruption is unlikely. However, local access is a prerequisite for exploitation. Organizations should assess who has local administrative access to these systems.
Who needs to act first
Teams should prioritize systems that are accessible to local users with administrative privileges. Check whether any workstations or management interfaces allow direct CLI access. If local access is restricted, the risk is lower. Roll out any future fixes by testing in a non-production environment first. Back up configurations before making changes. Monitor system logs for unexpected daemon restarts. Reduce exposure by limiting local login capabilities where possible.
What to do and how to stay safe: Fortinet
- Audit local access controls on FortiOS, FortiProxy and FortiSwitch devices to ensure only authorized personnel can log in locally.
- Monitor system logs for unexpected crashes of the newcli daemon, which may indicate exploitation attempts.
- Restrict CLI command execution to essential functions where possible to reduce the attack surface for crafted commands.
- Once the vendor provides an update, apply it promptly after testing in a controlled environment to ensure stability.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The CVSSv3 score is 2.1, which is considered low severity.
What products are affected by this double free flaw?
FortiOS, FortiProxy and FortiSwitch are affected by this vulnerability.
Is there a patch available for this issue?
No patch or update has been confirmed as available in the source material.
