```
Posting Date: 2026/08/17
【Vulnerability Alert】 Major Security Vulnerability Found in Fortinet FortiWeb (CVE-2026-26035)
- Subject: 【Vulnerability Alert】 Major Security Vulnerability Found in Fortinet FortiWeb (CVE-2026-26035)
- Description:
- Forwarded from Taiwan Computer Emergency Response Team/Coordination Center Security Alert TWCERTCC-200-202608-00000012
- Fortinet FortiWeb is a web application firewall product that provides features including anomaly detection, API protection, bot mitigation, and advanced threat analytics. Recently, Fortinet issued a major security vulnerability advisory (CVE-2026-26035, CVSS: 9.8). An improper authentication vulnerability exists in FortiWeb's remote RADIUS administrator authentication configuration. When specific non-default settings are used, it may allow an unauthenticated remote attacker to log into the FortiWeb GUI/CLI using any random username and password.
- Affected Platforms:
- FortiWeb versions 7.2.0 through 7.2.12
- FortiWeb versions 7.4.0 through 7.4.11
- FortiWeb versions 7.6.0 through 7.6.6
- FortiWeb versions 8.0.0 through 8.0.2
- Recommendations:
- Please update to the following versions: FortiWeb version 7.2.13 or later, FortiWeb version 7.4.12 or later, FortiWeb version 7.6.7 or later, FortiWeb version 8.0.3 or later
- References:
Computer and Communication Center
Network System Division
