Fortinet FortiWeb CVE-2026-70466

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, no special network position, and no elevated attack complexity are required - exploitation is achievable by any remote unauthenticated actor who can reach the FortiWeb service over the network. The core limiting factor is impact scope: only low integrity impact (I:L) is confirmed, with no confidentiality or availability compromise per available data, bounding the direct damage of a successful bypass. A critical epistemic limitation applies: the CVE description's attack vector field is an unfilled template placeholder, so the precise HTTP endpoint, parameter class, or protocol feature targeted by the blocklist bypass remains undisclosed in this record. The actual exploitable surface may be narrower or more specific than the permissive CVSS vector implies - defenders should consult the Fortiguard advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-157 before assessing exposure. No special configuration or non-default deployment mode has been identified as a prerequisite in the available data.

The CVSS 3.1 base score of 4.8 (Medium) is anchored by a fully network-accessible, unauthenticated attack path (AV:N/AC:L/PR:N/UI:N) with scope unchanged and impact confined to low integrity (I:L), reflecting no confidentiality or availability loss per available data. Temporal metrics embedded in the supplied vector elevate real-world concern: E:P confirms proof-of-concept exploit code is publicly available, lowering attacker skill requirements, while RL:O and RC:C confirm the vulnerability is officially acknowledged and patched. The medium CVSS score risks underrepresenting operational impact because the affected product IS a security enforcement layer - a WAF blocklist bypass undermines protections for all applications behind FortiWeb, creating a multiplier effect that a raw base score cannot capture; even a mid-sized municipal IT team in zabrze depending on FortiWeb as a primary perimeter control would face meaningful downstream exposure across its protected application estate. No CISA KEV listing exists, suggesting opportunistic or targeted use rather than broad in-the-wild exploitation, and EPSS data was not provided in the input. A material uncertainty persists: the CVE description's attack vector field is a placeholder, meaning the actual exploitability surface cannot be independently verified from this record alone - defenders should not de-prioritize solely on the basis of the medium CVSS without consulting the Fortiguard advisory.

A remote, unauthenticated attacker identifies a network-accessible FortiWeb deployment and crafts HTTP request inputs specifically designed to fall outside the product's incomplete blocklist, bypassing access control enforcement logic without authentication or user interaction. Because proof-of-concept exploit code is publicly available, the attacker may leverage existing tooling to automate input permutation and identify bypassing payloads, resulting in unauthorized modification of application-layer data or controls protected by the WAF.