An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LFortinet Fortiweb
APPFortinet7.0.0 – 7.4.7 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2026-24858CRITICAL9.8⚠ KEVPL ✓same product
Fortinet – Auth Bypass przez FortiCloud SSO w wielu produktach
CVE-2025-64446CRITICAL9.8⚠ KEVPL ✓same product
Path Traversal w Fortinet FortiWeb umożliwiający zdalne wykonanie poleceń
CVE-2025-25257CRITICAL9.8⚠ KEVPL ✓same product
Krytyczna podatność SQL Injection w Fortinet FortiWeb — obejście uwierzytelnienia
CVE-2025-59719CRITICAL9.8PL ✓same product
Fortinet FortiWeb — pominięcie uwierzytelnienia SSO przez spreparowany SAML
CVE-2023-25610CRITICAL9.8PL ✓same product
Buffer Underflow w interfejsie administracyjnym Fortinet FortiOS / FortiProxy — RCE bez uwierzytelnienia