Fortinet Patches Eight Flaws, Including Two That Let Attackers Log In Without Real Credentials
Two high-severity bugs in Fortinet's security products could let criminals talk their way past login screens they should never be able to reach.
Key points
- Fortinet patched eight security flaws across its product range on a single Wednesday release, with two rated high-severity.
- CVE-2026-26035 in FortiWeb lets a remote attacker log in using any username and password when a specific optional setting is switched on.
- CVE-2026-70468 in FortiManager lets an attacker pretend to be a legitimate firewall device, though it requires a valid digital certificate.
- CVE-2026-70465 in FortiClient for Windows could allow criminals who can tamper with internet traffic to run their own code on a targeted machine.
- Fortinet says none of the eight flaws are being actively exploited right now.
Fortinet, the company behind a widely used family of firewalls and network security tools, pushed out fixes for eight software vulnerabilities this week. Two of them are serious enough to warrant prompt attention from anyone running the affected products.
How bad is the FortiWeb flaw?
Pretty bad if you have a specific optional setting switched on. FortiWeb is software that acts as a gatekeeper for web applications, filtering malicious traffic before it reaches a company's systems. The flaw, CVE-2026-26035, means a complete stranger on the internet can log into the FortiWeb management console using a random, made-up username and password.
The catch: it only works when an administrator has turned on a setting called "wildcard," which tells the system to accept any username that a remote authentication server sends back. That setting is off by default. Most deployments are safe. But organisations that enabled it without understanding the risk are exposed.
Fortinet fixed the bug in FortiWeb versions 8.0.3, 7.6.7, 7.4.12, and 7.2.13. If you cannot patch immediately, the company says simply disabling the wildcard setting closes the door.
What about the FortiManager bug?
FortiManager is the central control panel many large organisations use to manage dozens or hundreds of Fortinet firewalls from one place. CVE-2026-70468 is an authentication bypass, meaning it lets an attacker skip the normal identity check and impersonate a real firewall device that FortiManager already trusts.
The failure mode here is classic: a management plane that trusts device identity a little too readily. An attacker needs a valid digital certificate (a small file that proves identity, like a digital ID card) and a specific command-line option to be active on the target system. That raises the bar, but not high enough.
The third flaw worth knowing about
| Vulnerability | Product | What it does | Severity |
|---|---|---|---|
| CVE-2026-26035 | FortiWeb | Random login accepted when wildcard is on | High |
| CVE-2026-70468 | FortiManager | Attacker impersonates a managed firewall | High |
| CVE-2026-70465 | FortiClient for Windows | Tampered DNS can run attacker code | High |
FortiClient is endpoint security software installed on individual computers. CVE-2026-70465 is a buffer overflow bug, meaning the software can be tricked into writing more data than it has room for, which attackers exploit to run their own commands. The trigger is a poisoned DNS response. DNS, the domain name system, is the internet's address book, translating names like "company.com" into the numbers computers actually use. Anyone positioned to intercept or fake those lookups could exploit this flaw without needing a password at all.
The remaining five patches cover medium and low-severity issues in FortiWeb WAF (a web application firewall), FortiOS (the core operating system on Fortinet devices), and FortiSIEM (a security monitoring tool).
Fortinet says, as of publication, there is no evidence any of these flaws are being used in real attacks. That window tends to close fast once patches are public.
In practice, the operational takeaway is simple: patch FortiWeb and FortiManager this week, audit whether wildcard authentication was ever enabled, and check whether FortiClient endpoints are covered by your next update cycle.
