CVE-2026-106174

{
  "etk_id": "ETK-2026-2745",
  "cve_id": "CVE-2026-106174",
  "display_id": "CVE-2026-106174",
  "ghsa_id": "GHSA-jq7m-wj67-4h5c",
  "euvd_id": "EUVD-2026-110616",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper locking denial of service in FortiOS HTTPS management",
  "summary": "FortiOS 8.0.0 and versions 7.6.4 through 7.6.6 are affected by an improper locking flaw in the HTTPS management interface. An unauthenticated attacker that can reach the device over the network may make that management interface unavailable.",
  "mitigation": "Restrict HTTPS management access to trusted administrative networks and disable external exposure where possible. No fixed version is identified in the supplied evidence; apply a vendor-provided update when one is available.",
  "vendor": "Fortinet",
  "product": "FortiOS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "8.0.0",
        ">= 7.6.4, <= 7.6.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "FortiOS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.526372633333333,
  "t0_at": "2026-10-27T06:54:54.066000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T06:54:54.066000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T06:54:54.066000+00:00",
      "url": "https://github.com/advisories/GHSA-jq7m-wj67-4h5c"
    }
  }
}