An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2

CVE-2026-26035 is an authentication bypass in Fortinet FortiWeb (versions 7.0.0–7.0.12, 7.2.0–7.2.12, 7.4.0–7.4.11, 7.6.0–7.6.6, and 8.0.0–8.0.2) that lets an unauthenticated attacker log into the management GUI or CLI with *any* username and password. The flaw lives in the RADIUS-based admin authentication flow: when an admin account is configured as Remote Type with the wildcard option enabled, the appliance's credential-verification logic is effectively short-circuited. The attacker walks straight into a full admin session — no brute-force, no token theft, just arbitrary credentials accepted.

The NVD-style CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H → 9.8) treats this as a zero-click, zero-auth, internet-facing RCE-equivalent. That overstates reality. Fortinet themselves rate it High (roughly 8.8) because the wildcard setting is off by default and requires a deliberate, non-standard admin configuration. In noisgate's assessment the vendor is closer to correct: the vulnerable population is a fraction of the installed base, internet exposure is minimal (~300 FortiWeb management interfaces on Shodan), there is no public PoC, no KEV listing, and EPSS sits at the 0.51-percentile mark. However, FortiWeb is a network-edge WAF — compromise grants traffic inspection, policy manipulation, and a pivot point behind the perimeter — so the role-multiplier keeps the floor at HIGH.

Why this verdict

• Non-default config prerequisite narrows the blast radius. The wildcard setting on RADIUS admin accounts is off by default. Administrators must deliberately enable it. This is not a universally exploitable condition — it gates the entire chain.
• Minimal internet exposure. Only ~300 FortiWeb management interfaces are internet-reachable per Shodan. Most enterprises restrict WAF management to internal or OOB networks, further shrinking the attack surface.
• Role multiplier: network-edge WAF appliance. FortiWeb sits inline or in reverse-proxy mode in front of web applications. Admin compromise grants WAF policy manipulation, TLS private key export, decrypted traffic inspection, and a pivot point from DMZ into backend tiers. This is a canonically high-value network-edge role, which floors the verdict at HIGH despite the configuration friction.
• No exploitation signals. Zero PoCs, zero KEV, EPSS at 0.51% — the threat-intelligence picture is quiet. This permits a downgrade from the raw 9.8 CVSS but does not justify going below HIGH given the role.

Why not higher?

A CRITICAL rating would require either active exploitation or a universally exploitable condition. Here, the wildcard RADIUS config is non-default and likely affects a single-digit percentage of FortiWeb deployments. The ~300 internet-exposed instances and absence of any PoC or KEV listing mean the urgency does not reach CRITICAL tier. If a public PoC emerges or KEV listing occurs, this should be immediately re-evaluated.

Why not lower?

FortiWeb is a network-edge security appliance — it is not a workstation or low-value host. Compromise of a WAF grants the attacker a privileged network position with access to decrypted traffic, TLS keys, and backend server connectivity. The authentication bypass itself is trivially exploitable (any credentials work) once the prerequisite config exists. Dropping to MEDIUM would ignore the catastrophic blast radius that a WAF takeover represents in any enterprise with sensitive web applications behind it.

1. Disable the wildcard setting on all Remote-Type RADIUS admin accounts immediately — This is the vendor-recommended workaround and fully neutralizes the vulnerability without patching. Audit via CLI: config system admin-user → check for wildcard enable. Deploy within the noisgate mitigation SLA of 30 days for HIGH — but given the simplicity of the workaround, aim for same-day.
2. Restrict management interface access to allowlisted IPs or an out-of-band management network — Even if the wildcard config exists, limiting who can reach the login page eliminates remote exploitation. Use FortiWeb's trusted-host configuration or upstream ACLs. Deploy within 30 days per noisgate mitigation SLA.
3. Enable and monitor admin login alerts in your SIEM — FortiWeb logs all admin authentication events. Create a detection rule for admin logins from unexpected source IPs or with previously unseen usernames. This provides detection-in-depth while patching is scheduled.
4. Rotate TLS certificates and private keys on affected FortiWeb appliances after patching — If exploitation cannot be ruled out, assume TLS private keys stored on the WAF may have been exfiltrated. Re-key after patching to close the exposure window.

Run this script on each FortiWeb appliance via SSH as a read-only admin (or higher). Usage: bash check_cve_2026_26035.sh. No arguments needed. The script inspects the running config for RADIUS wildcard admin accounts and checks the firmware version.

#!/bin/bash
# check_cve_2026_26035.sh
# Checks FortiWeb for CVE-2026-26035 exposure
# Run on the FortiWeb appliance via SSH as admin
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

# Get firmware version
VERSION=$(fnsysctl cat /proc/version 2>/dev/null || echo "")
if [ -z "$VERSION" ]; then
  # Try alternative method
  VERSION=$(diagnose system info 2>/dev/null | grep -i 'version' | head -1 || echo "")
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine FortiWeb version. Run manually: 'get system status'"
  exit 2
fi

echo "[*] FortiWeb version info: $VERSION"

# Check for wildcard admin accounts via config dump
# This requires CLI access; adapt if using API
WILDCARD_CHECK=$(show system admin-user 2>/dev/null | grep -A5 'set type' | grep -c 'set wildcard enable' || echo "0")

if [ "$WILDCARD_CHECK" -gt 0 ]; then
  echo "VULNERABLE - Found $WILDCARD_CHECK admin account(s) with wildcard enabled."
  echo "Remediation: Disable wildcard on Remote-Type RADIUS admin accounts or upgrade."
  exit 1
else
  echo "PATCHED - No admin accounts with wildcard setting enabled found."
  echo "Note: Verify firmware is also updated to 8.0.3+, 7.6.7+, 7.4.12+, or 7.2.13+."
  exit 0
fi

Sources

1. Fortinet PSIRT Advisories
2. CyCognito Emerging Threat Analysis
3. SecurityWeek Coverage
4. RedLegg Security Bulletin
5. TheHackerWire Technical Analysis
6. GBHackers Coverage
7. H-ISAC Advisory
8. Fortinet Wildcard Admin Documentation