[NEW] [high] Fortinet FortiWeb: Multiple vulnerabilities enable bypass of security measures

highCVE-2026-26035 CVE-2026-70466

A remote, anonymous attacker can exploit multiple vulnerabilities in Fortinet FortiWeb to bypass security measures and manipulate data.

CSIRTS triage

vendor: Fortinet product: FortiWeb Authentication bypassOther

What: A remote, anonymous attacker can exploit multiple vulnerabilities to bypass security measures and manipulate data.
Who is affected: Any FortiWeb deployment accessible remotely.
Urgency: High priority; security control bypass without authentication is a critical threat.
Action: Apply Fortinet security patch for CVE-2026-26035 and CVE-2026-70466 immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiWeb

Get an email when a new FortiWeb advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-13
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2810

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-260350.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-704660.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-26035	coverage & exploitation status	NVD · CVE.org
CVE-2026-70466	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownNCSC-2026-0300 [1.00] [M/H] Vulnerabilities patched in Fortinet FortiWebncsc-nl
unknownFortinet Products Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Fortinet products (August 13, 2026)cert-fr-avis
mediumCVE-2026-70466: A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2,…nvd
criticalCVE-2026-26035: An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 th…nvd
unknownContent-Encoding WAF Evasionfortinet
unknownBroken access control in the RADIUS type admin groupfortinet

Recent advisories for Fortinet FortiWeb

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownNCSC-2026-0300 [1.00] [M/H] Vulnerabilities patched in Fortinet FortiWebncsc-nl · 2026-08-13
mediumCVE-2026-70466: A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2,…nvd · 2026-08-12
criticalCVE-2026-26035: An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 th…nvd · 2026-08-12
criticalexploitedCVE-2025-58034: Fortinet FortiWeb OS Command Injection Vulnerabilitycisa-kev · 2025-11-18
criticalexploitedCVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerabilitycisa-kev · 2025-11-14
criticalexploitedCVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerabilitycisa-kev · 2025-07-18