OTPulse

Double free in signal handler

Low RiskCVSS 2.1FG-IR-26-182Oct 13, 2026
Fortinet
IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries
Attack path
Attack VectorLocal
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary

Double free vulnerability in CLI command

What this means
What could happen
Could impact device confidentiality, integrity, or availability
Who's at risk
Organizations in critical infrastructure using Fortinet equipment
How it could be exploited
Attacker would need local or console access to the device with privileged credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (9)
8 with fix1 pending
ProductAffected VersionsFix Status
FortiOS7.6.0 - 7.6.7No fix yet
FortiOS7.4 all versionsMigrate to fixed release
FortiOS7.2 all versionsMigrate to fixed release
FortiProxy7.6.0 - 7.6.67.6.7+
FortiProxy7.4 all versionsMigrate to fixed release
FortiProxy7.2 all versionsMigrate to fixed release
FortiSwitch7.6.0 - 7.6.67.6.7+
FortiSwitch7.4 all versionsMigrate to fixed release
View full vendor advisory
API: /api/v1/advisories/82b19843-e653-4a5b-aea5-a45a5f5d366d

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Double free in signal handler | CVSS 2.1 - OTPulse