Fortinet Patches Critical Authentication Bypass in FortiWeb Allowing Login with Random Credentials

Fortinet has issued patches for several vulnerabilities affecting its FortiWeb, FortiManager, and FortiClient products. The updates address flaws that could enable unauthorized administrative access without valid credentials and allow code execution on Windows systems.

The primary vulnerability, identified as CVE-2026-26035, impacts FortiWeb and received a CVSS score of 8.8. It manifests when administrative accounts using remote RADIUS authentication are configured with the wildcard option, a setting that is not enabled by default. In this scenario, a remote unauthenticated attacker can bypass authentication entirely and access either the graphical user interface or the command-line interface by entering any random username and password combination.

Once authenticated, the attacker obtains full administrative privileges over the web application firewall, allowing complete control of security policies and traffic inspection rules. The flaw affects multiple FortiWeb release lines, specifically versions 8.0, 7.6, 7.4, 7.2, and 7.0. Fixed releases are now available: 8.0.3, 7.6.7, 7.4.12, and 7.2.13.

At the time of disclosure, there were no indications of active exploitation targeting the authentication bypass issues. Nevertheless, the potential for unauthenticated remote administrative access makes prompt updates a high priority for any exposed FortiWeb appliances that protect critical network segments.