Fortinet Authentication Vulnerabilities in FortiWeb and FortiManager

Fortinet has released security updates addressing eight vulnerabilities across its product portfolio. The most significant items include two high-severity authentication issues. CVE-2026-26035 affects FortiWeb deployments where the 'wildcard' setting is enabled for administrator accounts, allowing unauthenticated remote attackers to authenticate to the GUI or CLI using arbitrary credentials. A second issue, CVE-2026-70468, affects FortiManager, providing an authentication bypass that allows remote attackers to impersonate managed FortiGate appliances, provided a specific CLI option is enabled and the attacker possesses a valid certificate. Additionally, FortiClient for Windows is impacted by CVE-2026-70465, a high-severity buffer overflow vulnerability exploitable via crafted DNS responses, which could lead to arbitrary code execution. Organizations should prioritize patching or applying workarounds, such as disabling the wildcard administrative settings in FortiWeb.

Impact

Successful exploitation of these vulnerabilities could lead to full administrative unauthorized access to FortiWeb and FortiManager appliances, or remote code execution on FortiClient endpoints. These vulnerabilities expose critical security infrastructure to unauthorized manipulation, administrative takeover, and potential lateral movement within the network. There is currently no evidence of exploitation in the wild for any of the patched vulnerabilities.

Recommendation

• Apply the vendor-supplied patches for FortiWeb (versions 8.0.3, 7.6.7, 7.4.12, 7.2.13), FortiManager, and FortiClient immediately.
• For FortiWeb, review configurations to ensure the 'wildcard' setting for Admin User Groups is disabled if not strictly required by the organization's identity architecture.
• Monitor network traffic for anomalous DNS responses or attempts to interact with FortiManager administrative interfaces that originate from unauthorized or unexpected certificate-bearing clients.
• Monitor system logs for unexpected administrative login events (e.g., successful logins with unknown or non-standard usernames) specifically targeting FortiWeb and FortiManager administrative services.