A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HFortinet Fortiweb
APPFortinet7.0.0 – 7.0.11 (excl.)7.2.0 – 7.2.11 (excl.)7.4.0 – 7.4.8 (excl.)7.6.0 – 7.6.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2026-24858CRITICAL9.8⚠ KEVPL ✓same product
Fortinet – Auth Bypass przez FortiCloud SSO w wielu produktach
CVE-2025-64446CRITICAL9.8⚠ KEVPL ✓same product
Path Traversal w Fortinet FortiWeb umożliwiający zdalne wykonanie poleceń
CVE-2025-25257CRITICAL9.8⚠ KEVPL ✓same product
Krytyczna podatność SQL Injection w Fortinet FortiWeb — obejście uwierzytelnienia
CVE-2025-59719CRITICAL9.8PL ✓same product
Fortinet FortiWeb — pominięcie uwierzytelnienia SSO przez spreparowany SAML
CVE-2023-25610CRITICAL9.8PL ✓same product
Buffer Underflow w interfejsie administracyjnym Fortinet FortiOS / FortiProxy — RCE bez uwierzytelnienia