{"affected":[{"defaultStatus":"unaffected","product":"FortiOS","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.4","versionType":"semver"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM APE1808","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-106174","cwes":["CWE-667"],"description":"A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.","epss":{"date":"2026-11-09","percentile":0.20882,"score":0.00282},"exploits":[],"kev":null,"metrics":[{"score":6.7,"severity":"medium","source":"CNA: fortinet","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","version":"3.1"}],"modifiedAt":1794314997561,"publishedAt":1793084094066,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-181"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-127084.html"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to FortiOS version 8.0.1 or above\nUpgrade to FortiOS version 7.6.7 or above"}],"revision":"44623321bc8268e0f6c845c6bd7ecfbd4453d4776f24c9278107d4048452df3c","sources":[{"modifiedAt":1794314997561,"name":"CNA: fortinet","retrievedAt":1794316387489,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106174"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794316406891,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106174"}],"ssvc":{"assessedAt":1793095996314,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2026-106174","updatedAt":1794316406891}