Loading story…
Fortinet disclosed CVE-2026-26035, a critical improper authentication flaw in FortiWeb that can let a remote, unauthenticated attacker log in to the product's GUI or CLI using a random username and password. The issue carries a CVSS 9.8 rating and affects multiple release lines, including 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, and 7.0.0-7.0.12. Fortinet tracked the bug under advisory FG-IR-26-158 and mapped it to CWE-287.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Fortinet announced a patch for CVE-2026-70468, an authentication bypass issue in FortiManager that could let a remote attacker impersonate any managed FortiGate device if a specific CLI option is enabled and the attacker has a valid certificate. The company said it had no evidence of in-the-wild exploitation.
Italy's ACN reported multiple vulnerabilities affecting Fortinet products, including high-severity issues in FortiWeb, FortiManager/FortiManager Cloud, and FortiClientWindows. It described the issue types as authentication bypass, remote code execution, and security restrictions bypass, and advised organizations to apply vendor-recommended updates.
Fortinet published advisory FG-IR-26-158 for CVE-2026-26035, an improper authentication vulnerability in FortiWeb that could let a remote unauthenticated attacker log in to the GUI or CLI using a random username and password. The advisory identifies affected FortiWeb versions across the 8.0.x, 7.6.x, 7.4.x, 7.2.x, and 7.0.x branches and recommends updating to patched versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcecybersecuritynews.com
Open sourcecsirt.sk
Open sourcesecurityweek.com
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcefortiguard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet patched a high-severity authentication bypass flaw in **FortiWeb** tracked as `CVE-2025-52970`, which can allow a remote unauthenticated attacker to obtain administrator privileges under certain conditions. The vulnerability stems from improper validation and processing of the `Era` parameter in cookies, which can cause the server to use a null secret key for session encryption and HMAC signing, enabling forged authenticated sessions. Affected versions are **FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10**. The flaw carries a **CVSS v3.1 score of 7.7**, and Fortinet has released fixes in **7.6.4, 7.4.8, 7.2.11, and 7.0.11** and later, with guidance to upgrade immediately to prevent unauthorized administrative access.
Jul 24, 2026
A critical authentication bypass vulnerability in Fortinet FortiWeb web application firewalls has been actively exploited in the wild, allowing unauthenticated attackers to create new administrator accounts and fully compromise affected devices. The flaw, which was silently patched in version 8.0.2, enables attackers to send crafted HTTP POST requests to a specific endpoint (`/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi`) to add privileged users. Security researchers from watchTowr, Defused, and Rapid7 have confirmed exploitation attempts since early October, with proof-of-concept exploits and detection tools now publicly available. The vulnerability has not yet been assigned a CVE, and Fortinet has not released an official advisory or comment as of the latest reports. Organizations running FortiWeb versions prior to 8.0.2 are urged to update immediately or restrict public access to the management interface. Security teams should check for unauthorized admin accounts and investigate for potential compromise if their systems have been exposed since early October. The identity of the threat actors remains unknown, but the attacks are widespread and indiscriminate, targeting internet-facing FortiWeb devices. Researchers have published indicators of compromise and recommended urgent mitigation steps to prevent further exploitation.
Jun 29, 2026
A critical vulnerability, CVE-2025-64446, has been identified in the GUI component of Fortinet FortiWeb, a web application firewall. This relative path traversal flaw allows remote, unauthenticated attackers to execute administrative commands on affected systems via crafted HTTP or HTTPS requests, potentially granting root access. The vulnerability affects FortiWeb versions 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1. Multiple sources confirm that this vulnerability is being actively exploited in the wild, and it has been added to CISA's Known Exploited Vulnerabilities catalog. Fortinet and cybersecurity authorities strongly urge organizations to upgrade to the latest patched versions: 7.0.12, 7.2.12, 7.4.10, 7.6.5, or 8.0.2 or later, depending on the affected release. Security advisories from both Fortinet and the Canadian Centre for Cyber Security emphasize the urgency of identifying and patching vulnerable systems immediately to mitigate the risk of compromise. Organizations are advised to use asset inventory tools to locate potentially impacted FortiWeb devices and apply the recommended updates without delay.
Jun 29, 2026