CVE-2026-26035

Executive Summary

CVE-2026-26035 is a critical Improper Authentication vulnerability (CWE-287) affecting Fortinet FortiWeb web application firewall appliances across five major version tracks (7.0.x through 8.0.x). The flaw allows a remote, unauthenticated attacker to successfully authenticate to the FortiWeb GUI or CLI using a random username and password, effectively bypassing all authentication controls. With a CVSS score of 9.8 and a vector indicating network-based, low-complexity exploitation with no privileges or user interaction required, this vulnerability exposes affected devices to complete compromise. As of the time of this report, no vendor patch has been released, and no patch evidence exists from any tracked source, meaning all affected versions remain exposed. Given FortiWeb's role as a perimeter security appliance positioned inline with web applications, successful exploitation grants adversaries full administrative control over the device, potentially enabling traffic interception, rule manipulation, and lateral movement into the protected application environment.

Technical Analysis

The vulnerability is classified as CWE-287 (Improper Authentication), indicating a fundamental failure in the authentication mechanism of the FortiWeb web management interface. The NVD description states that a remote unauthenticated attacker can "login into the FortiWeb GUI/CLI with a random username and password." This description reveals the core mechanism: the authentication logic accepts essentially arbitrary credentials — a random username and random password — and grants access as if valid authentication had occurred.

This class of vulnerability typically arises from one of several underlying root causes:

1. Authentication bypass via flawed comparison logic: The authentication routine may improperly compare the supplied credentials against stored credentials, potentially failing to validate the input against any expected value. This could occur if the comparison function contains a logic error — for example, if the comparison is only performed against an empty string, a null value, or if the authentication check short-circuits in a manner that always evaluates to true.

2. Default or hardcoded credential acceptance: The system may accept any credentials when certain conditions are met (e.g., when a debug flag is set, when specific configuration parameters are misconfigured, or when the system is in a particular operational state).

3. Session or state management flaw: The authentication flow may incorrectly initialize session state, allowing a request bearing arbitrary credentials to be treated as authenticated if the authentication module fails to properly reject invalid credentials.

Because the NVD description does not specify the exact implementation detail of the flaw, the precise code path cannot be determined from the available data. However, the described behavior — successful authentication with random credentials — indicates a complete failure of the credential validation step rather than a partial bypass or privilege escalation.

The attack surface is the FortiWeb management interface, which is exposed via both a GUI (typically HTTPS web interface) and a CLI (typically SSH or serial console). For the GUI, the attack vector is an HTTP/HTTPS request to the authentication endpoint. For the CLI, the attack vector is an SSH or console session attempting login. In both cases, the attacker sends credentials consisting of random username and password strings, and the vulnerable authentication logic accepts them.

The vulnerability affects multiple version tracks simultaneously — FortiWeb 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and 7.0.0 through 7.0.12 — indicating the flaw was likely introduced at a shared code branch point and propagated across all subsequent releases. This broad version impact suggests the vulnerability may have existed for an extended period.

Exploitation Scenarios

Based on the NVD description, the attack chain for CVE-2026-26035 is as follows:

Step 1: Reconnaissance and Target Identification
An attacker begins by identifying internet-exposed FortiWeb management interfaces. The GUI typically responds on HTTPS (default port 443) and presents a login page. The CLI is accessible via SSH on port 22. Attackers can use Shodan or other search engines with queries such as title:"FortiWeb" or product:"FortiWeb" to identify candidate targets. Additional reconnaissance may include banner grabbing to confirm the exact FortiWeb version to determine if it falls within an affected range.

Step 2: Triggering the Authentication Bypass
For the GUI: The attacker sends an HTTP request to the login endpoint of the FortiWeb web interface, supplying arbitrary credential values — a random username and a random password. For the CLI: The attacker initiates an SSH session to the device and supplies arbitrary credentials at the authentication prompt. Because the vulnerability causes the authentication check to accept random credentials, these requests will be processed as valid login attempts.

Step 3: Payload/Execution Method
At the vulnerability-class level, the attacker's "payload" is simply the arbitrary credential pair. The mechanism is the improper authentication check — the application fails to correctly validate the supplied credentials and grants access. No complex exploit payload, buffer overflow, or injection of executable content is required. The attack is purely a credential submission that the vulnerable code path accepts. It is plausible that the submission may need to conform to certain format requirements (e.g., valid character set for usernames and passwords, appropriate HTTP request format), but no specialized exploit code is necessary.

Step 4: Post-Exploitation Impact
Once authenticated, the attacker gains full administrative access to the FortiWeb appliance. This enables:

• Complete device compromise: All admin functions become available, including configuration changes, firmware updates, and system-level command execution.
• Traffic inspection and interception: The attacker can modify WAF rules, logging policies, and traffic forwarding settings.
• Data exfiltration: Access to logs, session data, and potentially cached traffic content.
• Lateral movement: The compromised FortiWeb device sits inline with backend web applications; the attacker can pivot to attack those applications directly or use the device as a beachhead for further network intrusion.
• Denial of service: An attacker could disable WAF protections, allowing malicious traffic to reach protected backends, or could take the device offline entirely.

No public PoC is available for this vulnerability at the time of writing; the attack chain is inferred from the vulnerability class and NVD description. The low complexity of exploitation (AV:N/AC:L/PR:N/UI:N) combined with the critical confidentiality, integrity, and availability impact underscores the severity of this flaw. Affected devices should be treated as compromised if any suspicious login attempts have been observed.

Impact Assessment

The CVSS score of 9.8 (Critical) reflects the maximum possible severity for a remotely exploitable vulnerability with no authentication requirement. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates:

• Attack Vector: Network (AV:N) — The vulnerability is exploitable remotely over the network without any physical or local access requirement.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions must be overcome; exploitation is simple and repeatable.
• Privileges Required: None (PR:N) — The attacker needs no prior access to any account or system resource.
• User Interaction: None (UI:N) — No victim action is required.
• Scope: Unchanged (S:U) — The compromise is limited to the vulnerable component.
• Confidentiality: High (C:H) — Full administrative access enables access to all device configurations, logs, and potentially traffic data.
• Integrity: High (I:H) — An attacker can modify all device settings, WAF rules, and system files.
• Availability: High (A:H) — An attacker can disable the device, disrupt traffic flow, or cause denial of service.

Business Impact: FortiWeb is a web application firewall positioned directly in front of business-critical web applications. Its compromise removes the security layer protecting those applications and provides the attacker with a privileged position on the network. For organizations relying on FortiWeb for PCI-DSS or other compliance mandates, a compromise could necessitate re-audits and may trigger disclosure obligations. The administrative access gained also allows the attacker to disable logging and other forensic capabilities, potentially evading detection of the initial breach.

Blast Radius: The affected version ranges span five major tracks, suggesting a very large installed base. Any FortiWeb device with management interfaces exposed to the internet (or to untrusted network segments) is directly at risk. Even devices on internal networks are at risk if the attacker can reach management ports through pivoting from another compromised host. Since FortiWeb appliances are often deployed at network perimeter, the chance of internet exposure is significant.

CVSS Subscore Remark: The high scores across all three impact metrics (C:H/I:H/A:H) reflect that this is a full administrative compromise. The absence of any interaction or privilege requirements makes this a high-priority target for automated exploitation once details become public. Organizations should not underestimate the urgency of addressing this vulnerability despite the lack of a confirmed patch.

Detection Guidance

The following detection rules are designed to identify exploitation attempts against CVE-2026-26035. Since exploitation involves successful authentication with arbitrary credentials, detection focuses on monitoring for anomalous successful login events on FortiWeb management interfaces, including patterns indicating repeated login attempts, logins with unusual usernames, and successful authentications from unexpected source IPs.

Sigma Rule

title: FortiWeb Authentication Bypass - Random Credential Login (CVE-2026-26035)
id: 5a8c94d7-8d3e-4a0c-bc2e-6f7d8e9a0b1c
status: experimental
description: Detects potential exploitation of CVE-2026-26035 - successful login to FortiWeb GUI/CLI with random username and password
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
  category: authentication
  product: fortinet
  service: fortinet
detection:
  selection_fortiweb_login:
    - field: msg
      strings:
        - 'Login'
        - 'Authentication'
        - 'auth'
  selection_success:
    - field: status
      strings:
        - 'success'
        - 'succeed'
        - 'passed'
  condition: selection_fortiweb_login and selection_success
  timeframe: 5m
falsepositives:
  - Legitimate administrative logins
  - Scheduled automation tasks using service accounts
level: high

YARA Rule

rule FortiWeb_Auth_Bypass_CVE_2026_26035
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects FortiWeb logs indicating login with random credentials"
        date = "2026-01-01"
        cvss = "9.8"
        cve = "CVE-2026-26035"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-26035"
    strings:
        $s1 = "Login succeeded" ascii wide nocase
        $s2 = "Authentication success" ascii wide nocase
        $s3 = "admin login" ascii wide nocase
        $s4 = "CLI login" ascii wide nocase
        $s5 = "random" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x504B0304 or filesize < 10MB
        and 1 of ($s*)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"ET EXPLOIT FortiWeb Authentication Bypass Attempt (CVE-2026-26035)"; flow:established,to_server; content:"POST"; http_method; content:"login"; http_uri; content:"username="; http_client_body; content:"password="; http_client_body; classtype:attempted-admin; reference:cve,2026-26035; sid:3000001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [authentication where event.action == "authentication_failed"
   and process.name == "*fortiweb*"]
  [authentication where event.action == "authentication_success"
   and process.name == "*fortiweb*"
   and user.name != "admin"]

Splunk SPL Query

index=fortinet sourcetype=fweb
| where match(msg, "(?i)(auth|login)")
| search (status="success" OR status="passed" OR msg="*login succeeded*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, user, device_name
| where count > 5
| eval severity = "critical"
| table _time, src_ip, user, device_name, count, first_seen, last_seen, severity

Wazuh OSSEC Rule

<group name="fortinet,fortiweb,cve-2026-26035,">
    <rule id="100260" level="12">
        <decoded_as>fortiweb</decoded_as>
        <field name="msg">Login succeeded</field>
        <description>FortiWeb login success - possible CVE-2026-26035 authentication bypass</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>fortiweb_auth_bypass</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-26035 has a patch confidence of 0/4 — no patch evidence exists from any tracked source. The vulnerability is considered UNPATCHED across all affected version ranges as of the time of this report.

Immediate Mitigations (to be implemented without delay):

1. Restrict management interface access: Use access control lists (ACLs) or firewall rules to restrict access to the FortiWeb GUI and CLI management interfaces to only trusted IP addresses and management networks. Do not expose management interfaces to the internet or untrusted networks.
2. Disable remote management if possible: If local console access is available, consider disabling GUI and SSH remote management entirely until a patch is available.
3. Enable strict access policies: If the FortiWeb device supports it, configure source IP allowlisting for all management access.
4. Deploy network-level monitoring: Implement the detection rules provided in this report to identify and alert on anomalous login activity.
5. Segment management networks: Ensure FortiWeb management interfaces are on a separate network segment from user-facing and internet-facing traffic.

Patch/Upgrade Steps:

1. Monitor Fortinet's official advisory channels (Fortinet Security Advisory page at https://www.fortiguard.com/psirt) for the release of a patched firmware version.
2. As soon as an update is released, test it in a non-production environment before rolling out to production devices.
3. Upgrade all affected FortiWeb devices to the patched version for their respective track.

Long-Term Hardening:

1. Follow Fortinet's hardening guides: Implement all vendor-recommended security configuration settings for FortiWeb devices.
2. Establish a patching cadence: Subscribe to Fortinet security advisories to ensure timely awareness of future vulnerabilities.
3. Use centralized authentication: Implement centralized AAA (e.g., TACACS+ or RADIUS) with proper access controls for all administrative access to network devices.
4. Monitor for suspicious activity: Maintain continuous monitoring of all FortiWeb logs, especially authentication-related events.
5. Perform regular security reviews: Periodically audit management interface exposure and access policies.

Until a patch is released, organizations should treat any FortiWeb device with exposed management interfaces as critically at risk and consider whether the device can be temporarily taken offline or isolated if its function is not immediately critical.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-26035
2. Fortinet PSIRT Advisories: https://www.fortiguard.com/psirt
3. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CWE-287 Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
5. Fortinet FortiWeb Product Page: https://www.fortinet.com/products/web-application-firewall/fortiweb

Known Threat Actor Activity: As of the date of this report, no publicly documented threat actor campaigns or exploit-in-the-wild evidence has been identified specifically targeting CVE-2026-26035. However, given the critical severity and trivial exploitation, this vulnerability is expected to be rapidly incorporated into automated exploit tooling once technical details become more widely disseminated. The device is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations should remain vigilant for signs of unauthorized access to FortiWeb devices, particularly those with internet-exposed management interfaces.