Key points
- The flaw allows local authenticated attackers to crash the newcli daemon via crafted commands.
- Fortinet revised the advisory on October 13, 2026, assigning a CVSSv3 score of 2.1.
- The vulnerability impacts FortiOS, FortiProxy, and FortiSwitch platforms according to FortiGuard PSIRT.
Fortinet updated its security advisory for a double free vulnerability found in FortiOS, FortiProxy, and FortiSwitch. The update, posted on October 13, 2026, clarifies the risk level for managed service providers and enterprise IT teams. The flaw, identified as CWE-415, allows a local attacker with authentication credentials to crash the newcli daemon. This occurs when the attacker sends crafted CLI commands to the affected systems. The advisory revision ensures that operators have the correct severity context for their risk assessments.
By the numbers
- 2.1: The CVSSv3 base score assigned to this double free vulnerability.
- 1: The number of distinct daemon components affected, specifically the newcli daemon.
- 3: The count of Fortinet product lines impacted, including FortiOS, FortiProxy, and FortiSwitch.
What the figures mean
A CVSSv3 score of 2.1 places this vulnerability in the low severity range. This indicates that exploitation requires local access and valid authentication credentials. The impact is limited to a denial of service condition for the newcli daemon, rather than remote code execution or data theft. For organizations, this means the immediate operational risk is minimal unless an attacker already has compromised local access. The revision on October 13, 2026, confirms that Fortinet has evaluated the exploitability and impact, settling on a low risk rating. This helps teams prioritize remediation efforts against higher-severity threats.
What should you do?
Teams should verify their current inventory of FortiOS, FortiProxy, and FortiSwitch devices to confirm exposure. Review access logs for any unusual CLI activity from authenticated users, as this could indicate attempted exploitation. Communicate the low severity rating to security leadership to adjust incident response priorities accordingly. Ensure that local administrative accounts are secured with strong authentication methods to mitigate the prerequisite for exploitation. Monitor vendor communications for any future updates or patches related to this advisory.
Operational impact
When a low-severity local flaw is reported, operational teams should focus on access control enforcement rather than immediate patching. Security managers need to inform network operations that the risk is contained to authenticated local users. Supplier risk teams should note that this does not represent a systemic failure but a specific daemon issue. Internal communications should emphasize that standard hardening practices, such as restricting CLI access, remain the primary defense. This approach prevents unnecessary downtime while maintaining security posture.
Background: Incident response plans
Incident response plans fail when teams assume they cover every attack vector or treat them as static documents. You must focus on decision trees, not scripts. Plan for communication breakdowns, not just technical fixes. Regular table-top exercises reveal gaps that documentation hides.
Read the full guide: Fix Incident Response Plans That Fail Under Pressure
What to do and how to stay safe: Fortinet
- Audit local administrative accounts on FortiOS, FortiProxy, and FortiSwitch to ensure least privilege principles are applied.
- Monitor system logs for unexpected crashes of the newcli daemon, which could signal exploitation attempts.
- Restrict CLI access to trusted networks and authorized personnel to reduce the attack surface for local threats.
- Review existing security policies to ensure they address local privilege escalation and daemon stability risks.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of the double free vulnerability in FortiOS?
The vulnerability has a CVSSv3 score of 2.1, which is rated as low severity.
Which Fortinet products are affected by this advisory?
FortiOS, FortiProxy, and FortiSwitch are affected by this double free vulnerability.
How can an attacker exploit this flaw?
A local authenticated attacker can exploit this by sending crafted CLI commands to crash the newcli daemon.
