Fortinet Patches Eight Flaws, Including Two That Let Attackers Log In Without Real Credentials
Two high-severity bugs in Fortinet's security products could let criminals talk their way past login screens they should never be able to reach.
Key points
- Fortinet patched eight security flaws across its product range on a single Wednesday release, with two rated high-severity.
- CVE-2026-26035 in FortiWeb allows a remote attacker to log in with any username and password when a specific optional setting is active.
- CVE-2026-70468 in FortiManager lets an attacker impersonate a legitimate firewall device, though it requires a valid digital certificate.
- CVE-2026-70465 in FortiClient for Windows could let anyone positioned to tamper with DNS lookups run arbitrary code on a targeted machine.
- Fortinet says none of the eight flaws are being actively exploited right now.
Fortinet, the company behind a widely used family of firewalls and network security tools, pushed out fixes for eight software vulnerabilities this week. Two warrant prompt attention from anyone running the affected products.
How bad is the FortiWeb flaw?
Pretty bad, if you've switched on a specific optional setting. FortiWeb is software that acts as a gatekeeper for web applications, filtering malicious traffic before it reaches a company's systems. The flaw, CVE-2026-26035, means a complete stranger on the internet can log into the FortiWeb management console using a random username and password they invented on the spot.
It only works when an administrator has enabled a setting called "wildcard," which tells the system to accept any username a remote authentication server sends back. That setting's off by default. Most deployments are safe. Organisations that enabled it without understanding the risk are exposed.
Fortinet addressed the bug in FortiWeb 8.0.3, 7.6.7, 7.4.12, and 7.2.13. Can't patch immediately? Disabling the wildcard setting closes the exposure.
What about the FortiManager bug?
FortiManager is the central control panel many large organisations use to manage dozens or hundreds of Fortinet firewalls from one place. CVE-2026-70468 is an authentication bypass that lets an attacker skip the normal identity check and impersonate a real FortiGate device that FortiManager already trusts.
The failure mode here is classic: a management plane that trusts device identity a little too readily. An attacker needs a valid digital certificate (a small file that proves identity, like a digital ID card) and a specific command-line option active on the target. That raises the bar. Not high enough, though. Authentication bypasses in management consoles rarely stay theoretical for long; we covered a comparable hole in Check Point's admin console back on 23 July, where ten organisations were hit before most teams had finished reading the advisory.
The third flaw worth knowing about
| Vulnerability | Product | What it does | Severity |
|---|---|---|---|
| CVE-2026-26035 | FortiWeb | Random login accepted when wildcard is on | High |
| CVE-2026-70468 | FortiManager | Attacker impersonates a managed firewall | High |
| CVE-2026-70465 | FortiClient for Windows | Tampered DNS can run attacker code | High |
FortiClient is endpoint security software installed on individual computers. CVE-2026-70465 is a buffer overflow bug, meaning the software can be tricked into writing more data than it has room for, which attackers exploit to run their own commands. The trigger is a poisoned DNS response. DNS, the domain name system, is the internet's address book, translating names like "company.com" into the numbers computers actually use. Anyone who can intercept or fake those lookups could exploit this without a password.
The remaining five patches cover medium and low-severity issues in FortiWeb WAF, FortiOS (the core operating system on Fortinet devices), and FortiSIEM (a security monitoring tool). Fortinet also published a separate advisory on CVE-2026-49975, an HTTP/2 denial-of-service attack affecting Apache HTTP Server.
Fortinet says, as of publication, there's no evidence any of these flaws are being used in real attacks. That window tends to close fast once patches are public. Patch FortiWeb and FortiManager this week, audit whether wildcard authentication was ever turned on, and make sure FortiClient endpoints are in your next update cycle.
