Fortiweb EUVD-2026-22340

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) indicates the attack is remotely accessible with low complexity, but requires high privileges (PR:H), meaning only authenticated administrators or highly privileged users can exploit it. The impact is limited to availability (denial of service only), with no confidentiality or integrity impact. The moderate CVSS score of 4.9 reflects this constrained threat model. The authentication barrier significantly reduces real-world risk, as the attacker must already possess administrator-level access to FortiWeb-a scenario that suggests insider threat or prior system compromise rather than opportunistic exploitation. The lack of any public exploit code or KEV confirmation further supports that this is a low-priority issue in the exploitation landscape, despite being a valid denial-of-service vector for accounts already compromised or internal threat actors.

An authenticated administrator with high-privilege access to a FortiWeb instance crafts a specially formatted request or configuration change that triggers an integer overflow in a packet-processing or memory-allocation routine. The overflow causes FortiWeb to crash or enter an unresponsive state, resulting in denial of service to legitimate web traffic that should be protected by the firewall. The attack requires prior high-privilege authentication, making it unlikely to be exploited by external attackers unless credentials are compromised.