Fortinet Patches Multiple Authentication Vulnerabilities in FortiWeb, FortiManager, and FortiClient

Fortinet has rolled out fixes for a batch of authentication-related vulnerabilities across its FortiWeb, FortiManager, and FortiClient product lines, urging administrators to patch quickly given the sensitivity of the affected systems.

The most severe of the bunch, tracked as CVE-2026-26035, sits in FortiWeb’s login mechanism and carries a CVSS score in the 8.8-to-9.8 range depending on the source, reflecting just how easy it would be to abuse in the wrong configuration.

According to Fortinet’s advisory, the flaw is an improper authentication issue (CWE-287) that surfaces when a FortiWeb administrator account is configured for Remote RADIUS Type authentication with the “wildcard” setting turned on.

Under that non-default configuration, the appliance can end up matching any username on the remote authentication server against a defined admin group, effectively letting a remote, unauthenticated attacker “log in to the FortiWeb GUI/CLI with a random username and password,” Fortinet explains.

In practice, that means an attacker doesn’t need to know or guess valid credentials at all, since the broken matching logic does the work for them, handing over administrative control of the web application firewall.

The bug impacts a wide range of FortiWeb releases, spanning versions 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and the older 7.0.x branch.

Fortinet has shipped corrected builds in FortiWeb 8.0.3, 7.6.7, 7.4.12, and 7.2.13, and organizations still running the legacy 7.0 line are advised to consult support channels for guidance since no fixed version has been named for that branch.

Where immediate patching isn’t feasible, Fortinet’s recommended workaround is straightforward: disable the wildcard setting on Remote Type administrator accounts, either through System > Administrators in the GUI or by running “set wildcard disable” under config system admin in the CLI.

As of the advisory’s publication, Fortinet has not observed active exploitation of the issue in the wild, but given the low complexity of the attack, that could change quickly.

FortiManager Vulnerability

A separate but equally concerning issue was patched in FortiManager, the centralized platform many enterprises use to configure and monitor fleets of FortiGate firewalls.

Tracked as CVE-2026-70468 and classified as an authentication bypass using an alternate path or channel (CWE-288), the flaw carries a CVSS v3.1 score of 8.1.

It stems from a weakness in the FGFM protocol that FortiManager uses to communicate with managed FortiGate devices, and exploitation requires a specific CLI configuration option along with a valid certificate.

If those conditions are met, an attacker could impersonate any FortiGate device under that FortiManager’s management, potentially manipulating firewall policies at scale.

Affected builds include FortiManager and FortiManager Cloud 7.6.1, 7.4.3 through 7.4.5, and 7.2.5 through 7.2.9, with fixes available in 7.6.2, 7.4.6, and 7.2.10, respectively.

Rounding out this patch cycle, Fortinet also addressed a high-severity buffer overflow in FortiClient for Windows, tracked as CVE-2026-70465.

The classic buffer copy flaw could let an unauthenticated attacker positioned to intercept or spoof DNS responses execute arbitrary code on a targeted endpoint via crafted network packets, affecting FortiClient Windows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.11.

Given Fortinet’s history as a recurring target for both opportunistic and state-linked threat actors, security teams running FortiWeb, FortiManager, or FortiClient should treat these updates as priority patches rather than routine maintenance.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.