NCSC-2026-0300 [1.00] [M/H] Vulnerabilities patched in Fortinet FortiWeb

unknownCVE-2026-26035 CVE-2026-70466

Fortinet has patched vulnerabilities in FortiWeb. The first vulnerability concerns Improper Authentication in multiple versions of FortiWeb, allowing an external, unauthenticated attacker to gain access to the GUI and CLI interfaces by submitting arbitrary login credentials. This vulnerability also occurs in FortiWeb systems configured with Remote Radius Type Admin Authentication under certain non-standard settings. This allows an attacker to bypass authentication mechanisms without valid credentials, potentially leading to obtaining administrative control over the device. The second vulnerability concerns an incomplete disallowed input list (CWE-184) in FortiWeb WAF, allowing unauthenticated attackers to gain access by making specific requests that circumvent intended input restrictions. This can undermine the effectiveness of WAF security rules and lead to unauthorized access or actions that the WAF is meant to prevent.

CSIRTS triage

vendor: Fortinet product: FortiWeb Authentication bypassaffected: Multiple versions affected (specific versions not listed)

What: Improper authentication allows external unauthenticated attackers to bypass login mechanisms and gain GUI/CLI access with arbitrary credentials; incomplete input validation in WAF bypasses security rules.
Who is affected: FortiWeb deployments across multiple versions, including systems with Remote Radius Type Admin Authentication configured.
Urgency: High urgency; attackers can gain administrative control without valid credentials and undermine WAF protections.
Action: Apply Fortinet's patches for CVE-2026-26035 and CVE-2026-70466 to affected FortiWeb deployments.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiWeb

Get an email when a new FortiWeb advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-13
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0300

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-260350.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-704660.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-26035	coverage & exploitation status	NVD · CVE.org
CVE-2026-70466	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Fortinet FortiWeb: Multiple vulnerabilities enable bypass of security measurescert-bund
unknownFortinet Products Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Fortinet products (August 13, 2026)cert-fr-avis
mediumCVE-2026-70466: A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2,…nvd
criticalCVE-2026-26035: An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 th…nvd
unknownContent-Encoding WAF Evasionfortinet
unknownBroken access control in the RADIUS type admin groupfortinet

Recent advisories for Fortinet FortiWeb

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEW] [high] Fortinet FortiWeb: Multiple vulnerabilities enable bypass of security measurescert-bund · 2026-08-13
mediumCVE-2026-70466: A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2,…nvd · 2026-08-12
criticalCVE-2026-26035: An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 th…nvd · 2026-08-12
criticalexploitedCVE-2025-58034: Fortinet FortiWeb OS Command Injection Vulnerabilitycisa-kev · 2025-11-18
criticalexploitedCVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerabilitycisa-kev · 2025-11-14
criticalexploitedCVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerabilitycisa-kev · 2025-07-18