Zero Radar
← feed
HighVulnerabilityCVE-2026-106174updated 27 Oct 2026, 11:47 UTC

FortiOS HTTPS admin interface can be crashed by crafted web requests

A flaw in Fortinet firewall software lets someone without a login send specially crafted web requests that can make the device's HTTPS admin page stop responding. The firewall itself is not stated to be taken over.

Official, 3 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or credentials needed
  2. 2Crafted HTTP requestsSent to the device's management port
  3. 3Locking flaw triggeredImproper locking in the HTTPS service
  4. 4Admin interface stallsManagement HTTPS becomes unavailable
  5. ResultAdmin web interface denied to legitimate users

What happened

An improper locking issue in Fortinet FortiOS 8.0.0 and FortiOS 7.6.4 through 7.6.6 allows unauthenticated remote attackers with network access to trigger a denial of service of the HTTPS management interface via crafted HTTP requests.

Why it is dangerous: Administrators may lose the ability to manage the firewall through its web interface, and the disruption can affect network operations for organisations that rely on these devices.

Are you affected?

You are affected if you run FortiOS 8.0.0 or FortiOS 7.6.4 through 7.6.6 with the HTTPS management interface reachable over the network.

FortiOS 8.0.0; FortiOS 7.6.4 through 7.6.6

What to do

  1. Check whether your Fortinet devices run FortiOS 8.0.0 or 7.6.4 through 7.6.6
  2. Apply the fixed FortiOS version from Fortinet's official advisory when it is available
  3. Restrict access to the HTTPS management interface to trusted internal networks only

Timeline

  1. 27 Oct 2026, 07:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 07:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 07:21 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 11:37 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  5. 27 Oct 2026, 11:47 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-106174 · GHSA-jq7m-wj67-4h5c
CVSS
7.5 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 07:16 UTC
On Zero Radar
27 Oct 2026, 07:21 UTC (5 min after disclosure)
Last change
27 Oct 2026, 11:47 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

FortiOS HTTPS admin interface can be crashed by crafted web requests · Zero Radar