Fortinet Advises on Local Double Free Flaw in CLI Daemon for FortiOS

Fortinet updated its security advisory on October 13, 2026, to address a double free vulnerability affecting FortiOS, FortiProxy and FortiSwitch platforms. According to FortiGuard PSIRT, this defect exists within the newcli daemon. The advisory identifies the issue as CWE-415, where a double free vulnerability may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. The organization rated the flaw with a CVSS v3 score of 2.1, classifying it as low severity. Security teams should note that this is a revision of a prior notice, and the core technical details regarding the daemon crash remain consistent with earlier reporting.

Root cause

The vulnerability is identified as a double free error, classified as CWE-415. The advisory title references a "Double free in signal handler," indicating the location of the defect. The source material does not provide further technical details on the specific memory management failure or the internal logic of the signal handler. The flaw is contained within the newcli daemon component. No additional root cause analysis or code-level explanation is provided in the revised advisory text.

Attack path

An attacker must be a local, authenticated user to exploit this vulnerability. The source material states that the flaw may allow such an attacker to crash the newcli daemon via crafted CLI commands. The advisory does not specify the exact nature of the crafted commands or the specific signal handler interactions required. The attack vector is strictly local and requires prior authentication. There is no indication in the source material of remote exploitation capabilities or unauthenticated access paths.

Affected versions

• FortiOS
• FortiProxy
• FortiSwitch

Mitigation

• Review local access policies to ensure only necessary personnel have CLI access.
• Apply the principle of least privilege to all administrative accounts.
• Monitor the newcli daemon for unexpected restarts or termination events.
• Wait for vendor confirmation before assuming a patch resolves this specific revision.

Detection notes

Security operations teams usually detect this activity by monitoring for unexpected termination of the newcli daemon in system logs. Teams should check whether the daemon restarts frequently after specific CLI commands are issued. Look for error messages related to memory allocation or signal handling failures in the audit logs. If the daemon crashes without a corresponding configuration change, investigate the command history. Containment moves involve restricting further CLI access for the suspected user account. Verify that the crash does not cascade into other management services.

What to do and how to stay safe: Fortinet

• Audit local user accounts with CLI access to ensure they are still required.
• Check system logs for recent newcli daemon crashes and correlate with user activity.
• Restrict shell access to jump hosts or management networks only.
• Once the vendor provides an update, apply it to affected FortiOS, FortiProxy and FortiSwitch instances.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability allow remote code execution?

No, the source material states it allows a local authenticated attacker to crash the newcli daemon.

What is the CVSS score for this double free flaw?

The CVSS v3 score is 2.1, which is considered low severity.

Which Fortinet products are affected by this issue?

FortiOS, FortiProxy and FortiSwitch are affected by this vulnerability.