Fortinet patches authentication bypasses in FortiWeb and FortiManager

August 13, 2026. Fortinet shipped a batch of eight security fixes spanning FortiWeb, FortiManager, FortiClient, FortiOS, and FortiSIEM. Two of them sit at the center of the batch: one lets an attacker log into FortiWeb with literally any credentials, the other lets an attacker impersonate a FortiGate toward its FortiManager. No active exploitation was observed at publication — but these are exactly the flaws that turn a firewall into an open door.

Fortinet has been a recurring target for years, and not just for opportunistic attackers: ransomware gangs go after its VPN boxes and admin interfaces the moment an authentication flaw drops. When the bypass lands on the management plane — FortiManager — it is no longer one appliance falling; it is the entire FortiGate fleet it controls.

FortiWeb: logging in with a made-up password

The most severe flaw in the batch is CVE-2026-26035, in the login mechanism of FortiWeb, Fortinet’s web application firewall. Its CVSS score ranges from 8.8 to 9.8 depending on the source, putting it firmly in the critical band.

The trigger conditions are precise. The bug — improper authentication (CWE-287) — only fires under one configuration: when a FortiWeb administrator account is set up with Remote RADIUS type authentication and the wildcard option is enabled. That is not the default, but it is hardly rare in organizations that federate admin access behind a central directory.

Under that setup, the appliance ends up matching any username on the remote authentication server against the administrator group. In practice, a remote, unauthenticated attacker can “log in to the FortiWeb GUI/CLI with a random username and password,” as Fortinet’s advisory puts it. They do not need to know, or even guess, a valid credential: the broken matching logic does the work for them, handing over administrative control of the WAF.

Affected releases span nearly every branch: 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, plus the legacy 7.0.x line. Fixes are available in 8.0.3, 7.6.7, 7.4.12, and 7.2.13. For 7.0.x, no fixed build is named — Fortinet points customers to support.

The immediate workaround is simple, which is what makes the flaw manageable while you plan the upgrade: disable the wildcard option on Remote-type accounts, either in the GUI (System → Administrators) or in the CLI with set wildcard disable under config system admin.

FortiManager: impersonating a FortiGate to rewrite policy

The second major flaw is quieter but potentially heavier at fleet scale. CVE-2026-70468, in FortiManager, is an authentication bypass using an alternate path or channel (CWE-288), scored 8.1 under CVSS v3.1.

FortiManager is the central platform enterprises use to configure and monitor fleets of FortiGate firewalls. The flaw lives in the FGFM protocol — the channel FortiManager uses to talk to the devices it manages. Exploitation requires a specific CLI configuration option combined with a valid certificate.

If those conditions hold, an attacker can impersonate any FortiGate under that FortiManager’s management. The consequence is not a footnote: it is the ability to rewrite firewall policy at fleet scale — open rules, disable protections, exfiltrate configurations. The management plane is where a compromise produces the most damage for the least effort.

Affected releases are FortiManager and FortiManager Cloud 7.6.1, 7.4.3 through 7.4.5, and 7.2.5 through 7.2.9. Fixes ship in 7.6.2, 7.4.6, and 7.2.10.

The rest of the batch: DNS, FortiOS, and an HTTP/2 bomb

The August 13 batch does not stop at the two authentication flaws. Three more deserve a CISO’s attention, because they hit very different layers.

• CVE-2026-70465, in FortiClient for Windows, is a classic buffer overflow (CWE-120). An unauthenticated attacker positioned to intercept or spoof DNS responses can run arbitrary code on the endpoint via crafted network packets. Releases 7.4.0 through 7.4.3 and 7.2.0 through 7.2.11 are affected.
• CVE-2026-71407, in FortiOS, is a stack-based buffer overflow (CWE-121) in the WAD daemon, exploitable via crafted sockets — but only when Kerberos and an explicit SOCKS proxy are configured.
• CVE-2026-49975 is an “HTTP/2 bomb” (CWE-789), an HPACK compression bomb combined with flow-control stalls that exhausts memory. It affects FortiWeb and FortiAppSec Cloud through their underlying Apache HTTP Server, fixed upstream in Apache 2.4.68.

Two further flaws round out the table without reaching the same severity: CVE-2026-70466, a FortiWeb WAF policy evasion via the Content-Encoding header (CWE-184), and CVE-2026-70467, an SSRF (CWE-918) in FortiSIEM reachable by an authenticated user.

What ties these eight flaws together is where they concentrate: the ingress layers — WAF, VPN client, interface daemon — and the management plane. That is the signature of a batch built to shrink exposed attack surface, not cosmetic housekeeping.

What to do, in order

The context argues for speed. Fortinet reports no active exploitation at publication, but the attack complexity on the two authentication flaws is low, and the vendor’s history — a recurring ransomware target on edge devices — says not to wait.

Three actions, in this order:

• FortiWeb on Remote RADIUS with wildcard. Check your administrator accounts now. If wildcard is enabled, turn it off without waiting for the patch — a two-minute workaround that neutralizes CVE-2026-26035 — then schedule the move to 8.0.3, 7.6.7, 7.4.12, or 7.2.13.
• FortiManager. Apply 7.6.2, 7.4.6, or 7.2.10 first. FortiGate impersonation over FGFM is the flaw with the most systemic impact: what is at stake is your ability to push policy across the whole fleet.
• FortiClient for Windows. Roll out the fixed builds to endpoints. Exploitation via spoofed DNS responses requires no user interaction, which makes it a silent endpoint-compromise vector.

For teams that cannot patch within days, Fortinet’s advisory at least documents a workaround for the most critical flaw. But a workaround on the WAF is not a substitute for the update: the 7.0.x branch of FortiWeb, with no named fix, should be treated as a residual risk to schedule — even if that means migrating branches.

Verdict

This August 13 batch contains no mass-exploited zero-day — at least not yet. It contains something worse for anyone who delays: low-complexity authentication flaws on the two most sensitive layers of a Fortinet deployment.

If you run FortiWeb with centralized RADIUS authentication, treat CVE-2026-26035 as an incident narrowly avoided: disable wildcard today, patch this week.

If you manage a fleet through FortiManager, CVE-2026-70468 is your top priority — a management-plane compromise propagates to every firewall it supervises, and no downstream detection rule compensates for policy modified at the source.

For the rest of the fleet, the reasoning is simple: Fortinet’s edge products are a permanent target, and this batch is a closing window of opportunity. Patch before the window opens from the other side.

References

• Cyber Security News — Fortinet Patches Multiple Authentication Vulnerabilities in FortiWeb, FortiManager, and FortiClient, August 13, 2026
• Fortinet PSIRT — FortiWeb improper authentication (CVE-2026-26035), August 13, 2026
• Fortinet PSIRT — FortiManager authentication bypass in FGFM (CVE-2026-70468), August 13, 2026
• H-ISAC — Fortinet Patches High-Severity Flaws in Various Products, August 13, 2026
• NVD — CVE-2026-26035
• NVD — CVE-2026-70468