The vulnerability is a Double Free (CWE-415) that can be triggered by sending specially crafted CLI commands. When the malicious input is processed, a freed memory block is referenced again, leading to a crash in the newcli daemon. The crash terminates the daemon and disrupts command‑line management, resulting in a denial of service.

Fortinet FortiOS, FortiProxy, and FortiSwitch are affected. For FortiOS, all versions from 7.0 through 7.6.8 (including the full 7.4 and 7.2 lines) are vulnerable. For FortiProxy, all versions from 7.0 through 7.6.6, including the 7.4 and 7.2 lines, are affected. For FortiSwitch, all versions from 7.0 through 7.6.6, also covering the 7.4 and 7.2 lines, are affected. No impact is listed for FortiSASE or FortiPAM in the CVE description or solution data.

The CVSS score of 2.1 indicates low overall risk. The vulnerability requires local authentication and can only crash the newcli daemon, so its impact is limited to a loss of service rather than compromise of confidentiality or integrity. The EPSS score shows a very low exploitation probability (less than 1 %) and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to log into the device, send malicious CLI commands, and trigger the double free to cause a denial of service. Because the exploit affects only local privileged users, the threat is moderate and the likelihood of exploitation is low.