External risk intelligence

FortiWeb Improper Authentication Allows Remote Administrator Login

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-26035

FortiWeb is a Web Application Firewall (WAF) designed as an internet edge security appliance. Its management interfaces and operational services are typically deployed to face the public internet or are positioned at the network perimeter to inspect incoming traffic, making it a highly likely candidate for public internet exposure.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Fortinet FortiWeb products that could allow an unauthenticated attacker to gain unauthorized access to the system's administrative interfaces. This issue impacts the integrity and confidentiality of the web application firewall's management functions.

Unauthenticated attackers can access administrative controls.
It affects a critical network security appliance.
Confirm relevance and exposure to FortiWeb.

Attack Path

How an attacker could exploit the issue

An attacker can remotely access the FortiWeb management interface over the network, bypassing authentication to gain unauthorized access. This vulnerability allows an unauthenticated attacker to log into the Fortiweb GUI or CLI with arbitrary credentials, potentially leading to further compromise.

Network access required.
Bypasses authentication on management interface.
Unauthorized GUI/CLI access.

Live Threat

Current exploitation, exposure, and threat context

A remote unauthenticated attacker may be able to log into the FortiWeb management interface using arbitrary credentials. This could lead to unauthorized access and control over the web application firewall.

FortiWeb management interface and configuration.
Remote unauthenticated access to GUI/CLI.
Unauthorized access and control of WAF.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this critical vulnerability likely falls to the security infrastructure or network security teams responsible for the FortiWeb Web Application Firewall, with potential coordination needed from application owners if specific applications are protected by the affected instances. The first practical step is to identify all deployed FortiWeb instances, confirm their exposure and business criticality, and then engage the accountable owner to plan remediation, prioritizing instances facing the internet or protecting critical assets.

Security infrastructure and application teams own this.
Verify FortiWeb instances and their exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Fortinet FortiWeb?

FortiWeb is a Web Application Firewall (WAF) appliance. Organizations deploy it at the network edge or perimeter to inspect incoming web traffic, protect hosted applications from malicious requests, and enforce security policies before data reaches internal servers.

What does CWE-287 mean for CVE-2026-26035?

CWE-287 refers to Improper Authentication. In the context of CVE-2026-26035, it means the FortiWeb system fails to correctly verify the identity of a user attempting to connect. Because of this flaw, the device will grant administrative access to the GUI or CLI even when provided with fake or random credentials.

How does an attacker trigger this vulnerability?

An attacker triggers this by reaching the device's management interface over the network. They do not need a valid account; they simply submit any username and password to gain entry. This bug does not rely on specific user actions, such as clicking a link or opening a file, to initiate.

Is my FortiWeb instance at risk?

According to Halo Surface Signal, FortiWeb is typically deployed at the network perimeter or facing the internet to perform its security functions. Because of this common placement, instances are highly likely to be reachable from the public internet, increasing the urgency of verifying your specific deployment's connectivity.

How should I respond to this vulnerability?

Start by creating a comprehensive inventory of all FortiWeb appliances within your environment. Once you have a list, identify which instances have management interfaces accessible over the network. Consult official guidance from Fortinet to understand the available security updates and prioritize patching for your most exposed or critical devices.

References

fortiguard.fortinet.com/psirt/FG-IR-26-158

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.