Loading story…
Fortinet patched a high-severity authentication bypass flaw in FortiWeb tracked as CVE-2025-52970, which can allow a remote unauthenticated attacker to obtain administrator privileges under certain conditions. The vulnerability stems from improper validation and processing of the Era parameter in cookies, which can cause the server to use a null secret key for session encryption and HMAC signing, enabling forged authenticated sessions.
Affected versions are FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. The flaw carries a CVSS v3.1 score of 7.7, and Fortinet has released fixes in 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later, with guidance to upgrade immediately to prevent unauthorized administrative access.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Fortinet released fixes for a high-severity FortiWeb authentication bypass flaw tracked as CVE-2025-52970. The issue affects multiple FortiWeb versions and can allow a remote unauthenticated attacker to gain administrator privileges by manipulating the Era cookie parameter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed **CVE-2026-26035**, a critical improper authentication flaw in **FortiWeb** that can let a remote, unauthenticated attacker log in to the product's **GUI or CLI** using a random username and password. The issue carries a **CVSS 9.8** rating and affects multiple release lines, including **8.0.0-8.0.2**, **7.6.0-7.6.6**, **7.4.0-7.4.11**, **7.2.0-7.2.12**, and **7.0.0-7.0.12**. Fortinet tracked the bug under advisory **`FG-IR-26-158`** and mapped it to **`CWE-287`**.
Aug 14, 2026
A critical authentication bypass vulnerability in Fortinet FortiWeb web application firewalls has been actively exploited in the wild, allowing unauthenticated attackers to create new administrator accounts and fully compromise affected devices. The flaw, which was silently patched in version 8.0.2, enables attackers to send crafted HTTP POST requests to a specific endpoint (`/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi`) to add privileged users. Security researchers from watchTowr, Defused, and Rapid7 have confirmed exploitation attempts since early October, with proof-of-concept exploits and detection tools now publicly available. The vulnerability has not yet been assigned a CVE, and Fortinet has not released an official advisory or comment as of the latest reports. Organizations running FortiWeb versions prior to 8.0.2 are urged to update immediately or restrict public access to the management interface. Security teams should check for unauthorized admin accounts and investigate for potential compromise if their systems have been exposed since early October. The identity of the threat actors remains unknown, but the attacks are widespread and indiscriminate, targeting internet-facing FortiWeb devices. Researchers have published indicators of compromise and recommended urgent mitigation steps to prevent further exploitation.
Jun 29, 2026
A critical path traversal vulnerability in Fortinet FortiWeb has been actively exploited by threat actors to create unauthorized administrative accounts on exposed devices without authentication. The flaw, which affects FortiWeb versions 8.0.1 and earlier, allows attackers to send specially crafted HTTP POST requests to a vulnerable endpoint, resulting in the creation of admin-level users with known usernames and passwords. Security researchers have observed a global increase in exploitation attempts, with attacks originating from a wide range of IP addresses and targeting unpatched systems. Fortinet has released a fix in version 8.0.2 and urges administrators to update immediately and check for signs of unauthorized access. Public proof-of-concept (PoC) code and exploitation tools have been released, further increasing the risk to organizations that have not yet applied the patch. Security firms, including Defused and watchTowr Labs, have confirmed the exploit and provided guidance and detection tools to help defenders identify and remediate vulnerable devices.
Jun 29, 2026