Fortinet Fixes Critical Vulnerabilities in FortiWeb and FortiManager

Updates for Eight Vulnerabilities

Fortinet has released security updates addressing eight vulnerabilities across FortiWeb, FortiManager, FortiClientWindows, FortiOS, and FortiSIEM. The announcement was published on August 13, 2026.

The four vulnerabilities described in greater detail affect authentication, access-control bypass, memory management, and denial-of-service exposure. There is no evidence that they are being actively exploited in the wild.

The most severe vulnerabilities affect FortiWeb and FortiManager, two components often deployed in strategic positions: FortiWeb protects web applications, while FortiManager centralizes the management of FortiGate devices.

FortiWeb: Administrative Access with Arbitrary Credentials

CVE-2026-26035 has a CVSS score of 9.8 and is classified as CWE-287, meaning improper authentication. Its vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unauthenticated remote attacker can access the FortiWeb GUI or CLI using an arbitrary username and password. The potential impact affects the confidentiality, integrity, and availability of the system.

However, exploitation depends on a non-default configuration. The wildcard option for administrator accounts must be enabled. In this configuration, FortiWeb may map any username received from a remote server to the Remote User account.

If a group is configured under Admin User Group, the device also checks whether the remote user’s group matches the group configured under User > User Group > Admin Group. This logic, intended to simplify remote-user management, can therefore become an unauthorized path to administrative access.

The affected versions are:

• FortiWeb 8.0.0–8.0.2
• FortiWeb 7.6.0–7.6.6
• FortiWeb 7.4.0–7.4.11
• FortiWeb 7.2.0–7.2.12
• FortiWeb 7.0.0–7.0.12

Fortinet fixed the issue in:

• FortiWeb 8.0.3
• FortiWeb 7.6.7
• FortiWeb 7.4.12
• FortiWeb 7.2.13

The available material does not specify a fix for the FortiWeb 7.0.x branch. Organizations unable to upgrade immediately should disable the wildcard setting for administrator accounts.

FortiManager: Potential FortiGate Impersonation

The second major vulnerability is CVE-2026-70468, classified as CWE-288, or authentication bypass through an alternate path or channel. It has a CVSS score of 8.1, with the following vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The vulnerability affects both FortiManager and FortiManager Cloud:

• FortiManager 7.6.1
• FortiManager 7.4.3–7.4.5
• FortiManager 7.2.5–7.2.9
• FortiManager Cloud 7.6.1
• FortiManager Cloud 7.4.3–7.4.5
• FortiManager Cloud 7.2.3–7.2.9

The available technical description refers to an authentication bypass and improper access to authorization controls. However, it does not clarify the specific attack vector and still contains a placeholder in the section describing the path used.

According to the operational description, a remote attacker can impersonate a FortiGate device managed by FortiManager. Exploitation requires a specific CLI option to be enabled and possession of a valid certificate.

These prerequisites increase the attack complexity, as reflected by the AC:H parameter in the CVSS vector, but they do not eliminate the risk to infrastructures using centralized management. A forged device identity could alter administrative operations or trust relationships between components.

No fixed versions have been provided for FortiManager or FortiManager Cloud. Administrators should therefore review Fortinet’s PSIRT advisories and, in the meantime, verify the required CLI option, valid certificates, and device registrations.

FortiClientWindows and Apache: Two Different Risks

CVE-2026-70465 affects FortiClientWindows and is classified as CWE-120, a buffer overflow caused by copying data without adequately validating the input size. It has a CVSS score of 8.1:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The affected versions are:

• FortiClientWindows 7.4.0–7.4.3
• FortiClientWindows 7.2.0–7.2.11

An unauthenticated attacker who can modify or craft DNS responses sent to the system may deliver specially crafted packets. The potential result is arbitrary code execution on the host.

The vector requires high attack complexity but no authentication or user interaction. Fixed versions and a workaround are not specified.

The advisory also includes CVE-2026-49975, associated with the HTTP/2 Bomb attack against Apache HTTP Server. The vulnerability has a CVSS score of 7.5:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

It is classified as CWE-789 and CWE-409. The issue involves excessive memory allocation in the mod_http module and can cause denial of service through malicious HTTP requests.

NVD lists the following as affected:

• Apache HTTP Server versions earlier than 2.4.68
• Debian Linux 11.0

The description also specifies Apache HTTP Server versions 2.4.17–2.4.67. No fixed version, mitigation, or update deadline is provided.

Other Products and the KEV Context

Fortinet also fixed medium- and low-severity vulnerabilities in FortiWeb WAF, FortiOS, and FortiSIEM. No CVE identifiers, affected versions, or fixed releases are available for these issues.

The four CVEs described here are not listed in CISA’s Known Exploited Vulnerabilities catalog, and no associated CISA deadline is provided. However, the absence of reported in-the-wild exploitation does not replace the need to verify and apply updates: FortiWeb may directly expose administrative interfaces, while FortiManager controls distributed infrastructures.

Over the past 90 days, the KEV catalog also added CVE-2026-34486 on August 4, 2026, and CVE-2022-0492 on June 2, 2026, involving the same Debian and Apache vendors referenced in the advisory. These entries do not demonstrate exploitation of the new vulnerabilities, but they show that components within the same ecosystem may already be targeted by offensive activity.

What Administrators Should Check

The immediate priority is to upgrade FortiWeb to at least version 8.0.3, 7.6.7, 7.4.12, or 7.2.13, depending on the installed branch. If the upgrade must be delayed, the wildcard option for administrator accounts should be disabled.

For FortiManager, administrators should verify the CLI configuration required by the vulnerability, valid certificates, and the associations between FortiGate devices and the management platform. They should also review device registrations and administrative activity for anomalies.

FortiClientWindows systems should be updated according to the fixed releases published by Fortinet. Apache HTTP Server and Debian systems should receive the updates provided by their respective maintainers, since the fixed versions are not specified in the available material.

Finally, security teams should review:

• authentication logs and GUI or CLI access to FortiWeb;
• associations between remote users and administrator groups;
• FortiGate device registrations and impersonation attempts;
• anomalies in DNS responses received by Windows endpoints;
• unusual HTTP requests and memory-usage spikes on Apache servers.