FortiWeb Flaw Lets Unauthenticated Attackers Log In With Random Username and Password
Brief
Fortinet has released security updates for a critical FortiWeb authentication vulnerability that could allow a remote, unauthenticated attacker to log in to the web application firewall using a random username and password.
Tracked as CVE-2026-26035, the flaw could expose graphical management and command-line administrative functions to unauthorized access. The vulnerability is classified as improper authentication, or CWE-287.
Instead of requiring a stolen password, a valid administrator account, or conventional brute-force activity, exploitation may allow an attacker to submit arbitrary credentials that the affected authentication workflow incorrectly accepts.
FortiWeb Flaw Lets Unauthenticated Attackers Log In
According to Fortinet’s advisory , the issue is associated with Remote RADIUS Type administrator accounts with the wildcard option enabled.