Fortinet has released security patches for a critical vulnerability in FortiWeb's authentication process that could allow remote attackers without authentication credentials to log into the web application firewall using random usernames and passwords This article explores vulnerability fortiweb authentication. . It is classified as improper authentication, or CWE-287.
In the vulnerable configuration, an attacker-supplied username could potentially match the Remote User account when relevant group mappings exist in the FortiWeb Admin User Group settings. Depending on assigned privileges and network design, this could allow for policy changes, visibility into web traffic, modification of security controls, or even preparation for further attacks against the application infrastructure.
This disclosure underscores an important operational lesson: non-default identity and remote-administration settings should be reviewed just as carefully as software versions, especially in perimeter security products like FortiWeb. Despite Fortinet not indicating active exploitation of CVE-2026-26035 when the vulnerability was disclosed, its remote, unauthenticated attack path and potential impact on web application firewall (WAF) administrative controls make prompt remediation essential. A remote unauthenticated attacker may trigger a stack-based buffer overflow issue through crafted sockets in FortiOS WAD configurations; this exploit requires Kerberos and SOCKS proxy conditions to be present.
A slow HTTP denial-of-service attack can be launched against the GUI of FortiWeb, FortiAppSec Cloud, or other Apache HTTP Server-dependent Fortinet products by an unauthenticated attacker who uses a crafted HTTP request.
