EUVD-2026-57193
GHSA-q9j3-5j7m-6w3x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated login bypass over the network with no interaction grants full admin control, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged as impact stays within the appliance.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
6DescriptionCVE.org
An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password
Articles & Coverage 2
AnalysisAI
Authentication bypass in Fortinet FortiWeb (versions 7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.0.2) lets a remote unauthenticated attacker log into the GUI/CLI management interface using an arbitrary, made-up username and password, granting full administrative control of the web application firewall. Tracked as CVE-2026-26035 (EUVD-2026-57193) and rated CVSS 9.8, this is an improper-authentication (CWE-287) flaw reported by Fortinet's own PSIRT (FG-IR-26-158). There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the trivial exploitability and network exposure make it a high-priority patch.
Technical ContextAI
FortiWeb is Fortinet's dedicated web application firewall (WAF) appliance, deployed as a physical or virtual gateway that inspects and protects HTTP/HTTPS traffic; the affected asset per CPE is cpe:2.3:a:fortinet:fortiweb across all versions. The vulnerability class is CWE-287 (Improper Authentication): the administrative authentication logic for the management GUI and CLI fails to correctly validate supplied credentials, so any random username/password pair is accepted rather than being checked against the real credential store. This is a logic/verification failure in the auth routine itself (not a memory-safety bug), which is why it requires no valid account, no user interaction, and no special privileges to abuse.
RemediationAI
Upgrade to a Fortinet-patched FortiWeb release as directed in advisory FG-IR-26-158 (https://fortiguard.fortinet.com/psirt/FG-IR-26-158); the advisory lists the fixed build for each affected train (upgrade past the highest vulnerable version in your branch, e.g. beyond 8.0.2, 7.6.6, 7.4.11, 7.2.12, or 7.0.12 - confirm the exact target build in the advisory rather than assuming). Because exploitation targets the management GUI/CLI, the most effective compensating control until patched is to remove the administrative interface from any untrusted network: restrict HTTP/HTTPS/SSH admin access to a dedicated management VLAN or trusted admin hosts via local-in/trusthost policies, and disable administrative access on internet-facing interfaces entirely. Trade-off: locking down trusthosts or the management interface can break remote administration and any external monitoring that touches the management plane, so stage a management jump host or VPN before applying these restrictions.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version
Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers t
Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.1
A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attac
Privilege escalation via path traversal affects multiple Fortinet appliances - FortiWeb (6.4, 7.0, 7.2, 7.4.0-7.4.4, 7.6
Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the
Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below,
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today