Fortinet FortiWeb EUVD-2026-57193

The attacker needs network reachability to the FortiWeb administrative GUI or CLI (the management interface) on a vulnerable build (7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, or 8.0.0-8.0.2); no valid account, no user interaction, and no prior foothold are required, and default configurations are affected because the flaw sits in the credential-verification path itself. The primary limiting factor is exposure of the management interface: deployments that restrict admin GUI/CLI access to a trusted management network or specific trusthosts are not remotely exploitable by arbitrary internet attackers, sharply reducing real-world reach despite the 9.8 base score.

This is a genuine top-priority issue, not a paper-tiger high CVSS. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a fully remote (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) attack yielding total confidentiality, integrity, and availability impact - the maximum realistic base score of 9.8. No EPSS score or SSVC decision was provided in the input, and the CVE is not currently on CISA KEV, so exploitation probability cannot be quantified from the data given; however, an unauthenticated admin-login bypass on an internet-facing security appliance is exactly the profile that historically attracts rapid exploitation. The vector is internally consistent with the description (remote, unauthenticated, full admin), so there is no conflicting signal to reconcile. Absence of a POC and KEV entry lowers the immediate certainty of active attack but does NOT lower the intrinsic severity - treat as emergency-patch priority for any internet-exposed management interface.

An attacker locates an internet-reachable FortiWeb management GUI or CLI, submits a login request with any arbitrary username and password, and is granted an authenticated administrative session without possessing valid credentials. From that admin session they can alter WAF policies to expose or attack protected web applications, exfiltrate configuration and secrets, or disable protections. No public exploit was identified at time of analysis, but the attack requires no tooling beyond a normal login request.