CVE-2026-106174

Quick assessment

Affected

Fortinet FortiOS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fortinet FortiOS 8.0.0 以及 7.6.4 至 7.6.6 版本中存在一个不正确的锁机制漏洞。若攻击者能够通过网络访问该设备，则无需进行身份验证即可通过构造恶意的 HTTP 请求，导致 HTTPS 管理界面出现拒绝服务（DoS）。

CVSS 6.7 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

加锁机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Fortinet	FortiOS	8.0.0	`cpe:2.3:o:fortinet:fortios:8.0.0:::::::*`

II. Public POCs for CVE-2026-106174

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-106174

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-106174 (1)

GUI Denial of Service

https://www.cve.org/CVERecord?id=CVE-2026-106174

IV. Related Vulnerabilities

Same product: FortiOS

Same vendor: Fortinet

Same weakness: CWE-667