Fortinet FortiWeb vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20211
3. 20221
4. 202327
5. 20244
6. 202528
7. 202612

Known exploitedNewest addition to KEV first

• CVE-2026-24858

  An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer…

  Fortinet · FortiWeb

  ExploitedCritical9.4
• CVE-2025-58034

  An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0…

  Fortinet · FortiWeb

  ExploitedMedium6.7
• CVE-2025-64446

  A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0…

  Fortinet · FortiWeb

  ExploitedCritical9.4
• CVE-2025-25257

  An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through…

  Fortinet · FortiWeb

  ExploitedCritical9.6

Newest CVEs

• CVE-2026-26035

  An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through…

  Fortinet · FortiWeb

  High8.8
• CVE-2026-70466

  A incomplete list of disallowed inputs vulnerability [CWE-184] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb…

  Fortinet · FortiWeb

  Medium4.8
• CVE-2026-40688

  An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through…

  Fortinet · FortiWeb

  Medium6.7
• CVE-2026-39811

  A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2…

  Fortinet · FortiWeb

  Medium4.4
• CVE-2026-39814

  Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1…

  Fortinet · FortiWeb

  Medium6.2
• CVE-2025-66178

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb…

  Fortinet · FortiWeb

  Medium6.7
• CVE-2026-24641

  A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all…

  Fortinet · FortiWeb

  Low2.5
• CVE-2026-24640

  A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all…

  Fortinet · FortiWeb

  Medium5.9
• CVE-2026-24017

  An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5,…

  Fortinet · FortiWeb

  High7.3
• CVE-2025-48840

  An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb…

  Fortinet · FortiWeb

  Medium5.0