CVE-2026-106175: Double Free in FortiOS newcli Daemon Crashes Management Plane on OT Perimeter Firewalls

Executive Summary

CVE-2026-106175 is a double free condition (CWE-415) in the Fortinet newcli daemon that a local authenticated attacker can trigger with crafted CLI commands, crashing the command line management process. The physical criticality is limited because exploitation requires authenticated access and the fault targets the management plane rather than the forwarding plane, but a crashed newcli daemon removes an operator's ability to configure or inspect a device that frequently sits on the IT/OT boundary.

Technical Exposure Breakdown

The vulnerable component is the newcli daemon, the process that parses and executes command line input on Fortinet platforms. A double free occurs when a program releases the same heap allocation twice, corrupting heap metadata. In the simplest outcome the daemon faults and terminates. Depending on allocator behavior, double free conditions can also be groomed toward controlled memory corruption, though the published CVSS score of 2.3 and the stated impact of crashing the daemon indicate the realistic ceiling here is denial of service against the management interface.

The attack vector is local and authenticated. An actor already holding CLI credentials sends crafted commands that drive the daemon into the double free. This is not a pre-authentication network reachable flaw, so it does not expand the external attack surface. It does matter for insider risk, shared administrative accounts, and any scenario where an attacker has already pivoted to a management session.

Per the grounding data, affected ranges include FortiOS 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13, and 7.0.0 through 7.0.19. FortiProxy is affected across 7.6.0 through 7.6.6, 7.4.0 through 7.4.14, 7.2.0 through 7.2.16, and 7.0.0 through 7.0.23. FortiSwitch is affected across 7.6.0 through 7.6.6, 7.4.0 through 7.4.10, and 7.2.0 through 7.2.10. FortiPAM is affected across multiple branches from 1.0.0 through 1.8.4. Patch status is listed as unknown in the source data, so operators should not assume a fixed build is available and should validate directly against vendor advisories before planning a change window.

OT Impact and Compliance Risk

Fortinet firewalls and FortiSwitch units are common choices for segmenting the IT/OT boundary and for building the demilitarized zone between enterprise and control networks. A loss of the CLI management daemon does not by itself stop traffic forwarding, but it blocks the operator's ability to make rule changes, pull diagnostics, or respond to an incident through the command line during the exact window when response speed matters.

For IEC 62443, this touches zone and conduit management integrity and the availability expectations placed on boundary devices. For NERC CIP operators, a management plane outage on a device enforcing the electronic security perimeter intersects with CIP-005 and CIP-007 obligations for access control and security event monitoring. Pipeline operators under TSA SD-02C should treat any degradation of segmentation enforcement points as relevant to the required network segmentation controls. Water utilities assessing risk under AWIA 2018 should account for the same loss of boundary device manageability.

Compensating Controls

Because the vector is local and authenticated, the primary mitigation is tightening administrative access. Enforce individual named accounts, remove shared admin credentials, and restrict CLI access to a dedicated out of band management network reachable only from hardened jump hosts. Enable multi factor authentication on administrative logins and review the trust model for any account that can reach the CLI.

Apply least privilege to administrative profiles so that operators who do not require full CLI scope cannot reach the command surface that triggers the fault. Log and alert on repeated newcli process restarts, which is the observable signature of attempted or successful exploitation. A Suricata rule concept here is of limited value because the trigger is delivered inside an authenticated management session rather than as distinct network traffic, so detection is better placed at the host and audit log layer.

Do not rely on active scanning to inventory affected Fortinet devices in OT zones. Aggressive probing of industrial components can brick fragile endpoints, so confirm versions through passive inventory and configuration management records rather than scanning the control network.

BreachSpider Intel footer: BreachSpider tracks CVE-2026-106175 and the full Fortinet affected product matrix for OT operators who need continuous monitoring of boundary device exposure.