EUVD-2026-22808
GHSA-m3qh-6w2c-jgrx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A out-of-bounds write vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
Out-of-bounds write in FortiWeb administrative interface enables authenticated remote code execution on web application firewall appliances. Affects FortiWeb 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.3. CVSS 7.2 indicates high-privilege authenticated network attack with low complexity. No public exploit identified at time of analysis, though the incomplete advisory description ('<insert attack vector here>') suggests disclosure may be pending or sanitized. Memory corruption class (CWE-787) typically enables arbitrary code execution, confirmed by CVSS impact ratings (High C/I/A). EPSS data not available for risk probability assessment.
Technical ContextAI
CWE-787 out-of-bounds write vulnerabilities occur when software writes data beyond allocated memory boundaries, enabling memory corruption and potential code execution. FortiWeb is Fortinet's web application firewall platform deployed to protect web applications from attacks. The vulnerability affects three major version branches across administrative functions requiring high privileges (PR:H in CVSS vector). Out-of-bounds writes in network-accessible management interfaces are critical because they bypass application-layer protections and can compromise the security appliance itself. The incomplete description in Fortinet's advisory (literal placeholder text '<insert attack vector here>') suggests either premature disclosure or deliberate sanitization of attack details pending patch deployment. CPE data not provided, but affected products are Fortinet FortiWeb versions 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.3.
RemediationAI
Organizations should immediately consult Fortinet advisory FG-IR-26-127 at https://fortiguard.fortinet.com/psirt/FG-IR-26-127 for patch availability and upgrade instructions. Based on affected version ranges, patched releases would typically be FortiWeb 8.0.4 or later, 7.6.7 or later, and 7.4.12 or later, though exact fix versions must be confirmed from the vendor advisory as the published description is incomplete. Until patching is complete, restrict administrative access to FortiWeb management interfaces using IP allowlisting, enforce multi-factor authentication for all administrative accounts, monitor for unauthorized administrative activity, and review admin account privileges following least-privilege principles. Organizations unable to patch immediately should consider isolating FortiWeb management interfaces on dedicated networks unreachable from untrusted zones.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today