Reported by 2 outlets

Timeline

1. original reporting

   Fortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Arbitrary Code

   gbhackers.com · 60d ago · August 14th, 2026

   Fortinet has released security updates to address high-severity vulnerabilities in FortiWeb and FortiClient for Windows. These vulnerabilities could allow unauthenticated attackers to access appliance administration interfaces or execute arbitrary code. The flaws CVE-2026-26035 and CVE-2026-70465 were disclosed as part of an August 2026 patch release that addressed eight security issues across various Fortinet products. The […] The post Fortinet FortiWeb and FortiClient Flaws Let Unauthenticated Attackers Gain Access and Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   FortiWeb Flaw Lets Unauthenticated Attackers Log In With Random Username and Password

   cyberpress.org · 60d ago · August 14th, 2026

   Fortinet has released security updates for a critical FortiWeb authentication vulnerability that could allow a remote, unauthenticated attacker to log in to the web application firewall using a random username and password. Tracked as CVE-2026-26035, the flaw could expose graphical management and command-line administrative functions to unauthorized access. The vulnerability is classified as improper authentication, or CWE-287. Instead of requiring a stolen password, a valid administrator account, or conventional brute-force activity, exploitation may allow an attacker to submit arbitrary credentials that the affected authentication workflow incorrectly accepts. FortiWeb Flaw Lets Unauthenticated Attackers Log In According to Fortinet’s advisory , the issue is associated with Remote RADIUS Type administrator accounts with the wildcard option enabled. Wildcard is disabled by default, limiting exposure in untouched installations. However, enterprises may enable remote authentication and wildcard account handling to simplify administrative access or integrate FortiWeb with centralized identity infrastructure. In the vulnerable configuration, an attacker-supplied username can potentially match the Remote User account when the relevant group mapping is present in the FortiWeb Admin User Group configuration. Affected releases include FortiWeb 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and 7.0.0 through 7.0.12. Fortinet has issued fixes in