CVE-2026-26035

No known exploitation. EPSS puts it in the 53rd percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile53rd0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-12Updated 2026-09-08Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your FortiWeb version and whether the FortiWeb management interface (GUI and/or CLI) is reachable from the internet or other external networks.
If you are on FortiWeb 8.0.0–8.0.2, upgrade to FortiWeb 8.0.3 or above.
If you are on FortiWeb 7.6.0–7.6.6, upgrade to FortiWeb 7.6.7 or above.
If you are on FortiWeb 7.4.0–7.4.11, upgrade to FortiWeb 7.4.12 or above.
If you are on FortiWeb 7.2.0–7.2.12 or 7.0.0–7.0.12, upgrade to the upcoming FortiWeb 7.2.13 or 7.0.13 or above as directed by Fortinet.
If you cannot upgrade immediately, restrict network access so the management interface is not reachable from untrusted networks (for example, block external access and allow only from your admin network).

Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password

In plain language

Written by AI from the record

Fortinet FortiWeb has a login-check flaw that lets an attacker access the admin interface with any username and password—so a typical small business should treat this as urgent if FortiWeb’s management console is reachable from the network.

Fortinet FortiWeb is vulnerable to an Improper Authentication issue (CWE-287) that allows unauthenticated remote attackers to bypass login checks and gain full administrative control over the device by attempting management-console access with arbitrary credentials.

If you're affected

Full administrative takeover
Service disruption risk
Compromise of web traffic
Potential ransomware leverage

What is it

This flaw means the usual “prove who you are” login check is broken on FortiWeb’s admin interface. An attacker can try random username/password combinations and still get in as an administrator if they can reach the management interface. Think of it like a security guard that accepts any badge—even blank ones—as long as someone can get to the front desk.

Who is affected

This matters if you run Fortinet FortiWeb and your management interface (GUI or CLI) can be reached over the network from places attackers could access (for example, the internet or other untrusted networks). The core risk applies only if the device is one of the listed vulnerable FortiWeb versions and the management interface is network-reachable.

How urgent is it

This is RED because attackers can bypass authentication entirely and gain full administrative control over FortiWeb remotely, with no account needed. Even though there is no confirmed dated public exploitation report in the findings, the flaw is straightforward to attempt from the network and is rated critical.

What to do — in detail

Confirm exposure
- Identify your FortiWeb version and check whether it falls within: 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12, or 7.0.0–7.0.12.
- Determine whether the FortiWeb management interface is reachable over the network: verify whether the management GUI/CLI is exposed to the internet or any untrusted network.
Upgrade to the fixed version (use the matching branch)
- For 8.0.0–8.0.2: upgrade to FortiWeb 8.0.3 or above.
- For 7.6.0–7.6.6: upgrade to FortiWeb 7.6.7 or above.
- For 7.4.0–7.4.11: upgrade to FortiWeb 7.4.12 or above.
- For 7.2.0–7.2.12: upgrade to the upcoming FortiWeb 7.2.13 or above.
- For 7.0.0–7.0.12: upgrade to the upcoming FortiWeb 7.0.13 or above.
If patching is delayed (temporary containment)
- Block external access to the FortiWeb management interface.
- Restrict management access to only your trusted admin network/VPN (so attackers cannot reach it over the network).
What to monitor after changes
- Look for management-interface login events that occur without legitimate admin activity.
- Review whether any configuration changes were made around the time of suspicious access attempts.
KEV status
- This CVE is not listed in CISA KEV in the provided findings.

Technical context

CVE-2026-26035 is a critical (CVSS 9.8) Improper Authentication vulnerability (CWE-287) affecting Fortinet FortiWeb versions 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12, and 7.0.0–7.0.12. The mechanism is authentication bypass: an attacker can reach the management interface over the network and log in using arbitrary (fake) username/password combinations, enabling full administrative control.

The findings indicate the target must have a vulnerable FortiWeb version running with its administrative interface accessible over the network; authentication is not required and no user interaction is needed. There is no KEV listing and no dated press claim of exploitation in the findings, and no public exploit code is listed. EPSS is predicted, but public guidance here is driven by the confirmed, high-impact nature of the authentication bypass described in the core findings and the RED traffic-light verdict.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS53rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 53rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 27 days, from the signal feeds we watch.

2026-09-08Patch availablerecord updated
2026-08-26Patch availablerecord updated
2026-08-15OpenVAS check added
2026-08-13Patch availablerecord updated
2026-08-12Patch availablepublished, weakness classified, att&ck mapped, record updated

Affected products

Fortinetcommercial · USaka forti net
- FortiWebSecurity Products

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable