Fortinet Patches Multiple Authentication Vulnerabilities in FortiWeb, FortiManager, and FortiClient

HomeCyber Security News Fortinet Patches Multiple Authentication Vulnerabilities in FortiWeb, FortiManager, and FortiClient By Guru Baran August 13, 2026 Fortinet Patches Multiple Authentication Vulnerabilities in FortiWeb, FortiManager, and FortiClient Fortinet has rolled out fixes for a batch of authentication-related vulnerabilities across its FortiWeb, FortiManager, and FortiClient product lines, urging administrators to patch quickly given the sensitivity of the affected systems. The most severe of the bunch, tracked as CVE-2026-26035, sits in FortiWeb’s login mechanism and carries a CVSS score in the 8.8-to-9.8 range depending on the source, reflecting just how easy it would be to abuse in the wrong configuration. According to Fortinet’s advisory, the flaw is an improper authentication issue (CWE-287) that surfaces when a FortiWeb administrator account is configured for Remote RADIUS Type authentication with the “wildcard” setting turned on. Under that non-default configuration, the appliance can end up matching any username on the remote authentication server against a defined admin group, effectively letting a remote, unauthenticated attacker “log in to the FortiWeb GUI/CLI with a random username and password,” Fortinet explains. In practice, that means an attacker doesn’t need to know or guess valid credentials at all, since the broken matching logic does the work for them, handing over administrative control of the web application firewall. The bug impacts a wide range of FortiWeb releases, spanning versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and the older 7.0.x branch. Fortinet has shipped corrected builds in FortiWeb 8.0.3, 7.6.7, 7.4.12, and 7.2.13, and organizations still running the legacy 7.0 line are advised to consult support channels for guidance since no fixed version has been named for that branch. Where immediate patching isn’t feasible, Fortinet’s recommended workaround is straightforward: disable the wildcard setting on Remote Type administrator accounts, either through System > Administrators in the GUI or by running “set wildcard disable” under config system admin in the CLI. As of the advisory’s publication, Fortinet has not observed active exploitation of the issue in the wild, but given the low complexity of the attack, that could change quickly. FortiManager Vulnerability A separate but equally concerning issue was patched in FortiManager, the centralized platform many enterprises use to configure and monitor fleets of FortiGate firewalls. Tracked as CVE-2026-70468 and classified as an authentication bypass using an alternate path or channel (CWE-288), the flaw carries a CVSS v3.1 score of 8.1. It stems from a weakness in the FGFM protocol that FortiManager uses to communicate with managed FortiGate devices, and exploitation requires a specific CLI configuration option along with a valid certificate. If those conditions are met, an attacker could impersonate any FortiGate device under that FortiManager’s management, potentially manipulating firewall policies at scale. Affected builds include FortiManager and FortiManager Cloud 7.6.1, 7.4.3 through 7.4.5, and 7.2.5 through 7.2.9, with fixes available in 7.6.2, 7.4.6, and 7.2.10, respectively. Rounding out this patch cycle, Fortinet also addressed a high-severity buffer overflow in FortiClient for Windows, tracked as CVE-2026-70465. The classic buffer copy flaw could let an unauthenticated attacker positioned to intercept or spoof DNS responses execute arbitrary code on a targeted endpoint via crafted network packets, affecting FortiClient Windows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.11. Given Fortinet’s history as a recurring target for both opportunistic and state-linked threat actors, security teams running FortiWeb, FortiManager, or FortiClient should treat these updates as priority patches rather than routine maintenance. CVE ID Affected Product Vulnerability Type Fixed Version(s) CVE-2026-26035 FortiWeb Improper authentication (CWE-287) via wildcard RADIUS setting allowing login with random credentials 8.0.3, 7.6.7, 7.4.12, 7.2.13 CVE-2026-70466 FortiWeb WAF Content-Encoding WAF evasion; incomplete list of disallowed inputs (CWE-184) letting attackers bypass WAF policies Not affected in 8.0.3+; upgrade to latest 7.x branch fix CVE-2026-70465 FortiClient for Windows Classic buffer overflow (CWE-120) exploitable via crafted/spoofed DNS responses Fixed in releases above 7.4.3 and 7.2.11 CVE-2026-70467 FortiSIEM Server-side request forgery (SSRF, CWE-918) allowing an authenticated attacker to trigger HTTP requests Upgrade path per affected 6.5–7.5.0 branches nvd.nist+1 CVE-2026-70468 FortiManager / FortiManager Cloud Authentication bypass via alternate path/channel (CWE-288) in FGFM protocol, enabling FortiGate impersonation 7.6.2, 7.4.6, 7.2.10 CVE-2026-71407 FortiOS Stack-based buffer overflow (CWE-121) in WAD daemon via crafted sockets (requires Kerberos + SOCKS explicit proxy) Upgrade beyond 7.6.6 tenable+1 CVE-2026-71408 FortiOS Allocation of resources without limits (CWE-770); slow HTTP DoS on the web UI Upgrade beyond affected 7.2/7.4/7.6.6 builds nvd.nist+1 CVE-2026-49975 FortiWeb, FortiAppSec Cloud (via Apache HTTP Server) “HTTP/2 Bomb” — memory allocation with excessive size value (CWE-789), an HPACK compression bomb combined with flow-control stalls causing memory exhaustion Mitigation via FortiWeb/FortiAppSec Cloud rules; upstream fix in Apache HTTP Server 2.4.68 cve+2  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. Tags cyber security news vulnerability Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Cyber Security Guide Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways  Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response  Latest Cyber News Cyber Attack News AmnesiaStealer macOS Malware Hijacks Browser Sessions via Fake GitHub Lure Cyber Security News Microsoft Exchange Server Vulnerabilities Enable DoS, Privilege Escalation, and RCE Attacks Cyber Security Trezor ShipMonk Data Breach Exposes Personal Data of Over 13,000 Hardware Wallet Customers Cyber Security News North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees Cyber Security News CISA Warns of Windows Ancillary Function 0-Day Vulnerability Exploited in Attacks Expert Talks Expert Talks From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking  Expert Talks Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage  Expert Talks Your Incident Response Plan Has a Dependency You Never Approved Expert Talks Security in the AI Era Starts with First Principles  Cyber Security News Planning Your AI Security – How will You Manage All Your Resources?