【Vulnerability Alert】 Major Security Vulnerability Found in Fortinet FortiWeb (CVE-2026-26035)

• Subject: 【Vulnerability Alert】 Major Security Vulnerability Found in Fortinet FortiWeb (CVE-2026-26035)

• Description:
  • Forwarded from Taiwan Computer Emergency Response Team/Coordination Center Security Alert TWCERTCC-200-202608-00000012
  • Fortinet FortiWeb is a web application firewall product that provides features including anomaly detection, API protection, bot mitigation, and advanced threat analytics. Recently, Fortinet issued a major security vulnerability advisory (CVE-2026-26035, CVSS: 9.8). An improper authentication vulnerability exists in FortiWeb's remote RADIUS administrator authentication configuration. When specific non-default settings are used, it may allow an unauthenticated remote attacker to log into the FortiWeb GUI/CLI using any random username and password.
• Affected Platforms:
  • FortiWeb versions 7.2.0 through 7.2.12
  • FortiWeb versions 7.4.0 through 7.4.11
  • FortiWeb versions 7.6.0 through 7.6.6
  • FortiWeb versions 8.0.0 through 8.0.2
• Recommendations:
  • Please update to the following versions: FortiWeb version 7.2.13 or later, FortiWeb version 7.4.12 or later, FortiWeb version 7.6.7 or later, FortiWeb version 8.0.3 or later
• References:
  1. https://www.twcert.org.tw/tw/cp-169-11107-8ed2b-1.html

Computer and Communication Center
Network System Division