Fortinet Patches Critical Authentication Flaws in FortiWeb and FortiManager, Urges Users to Update Immediately
In a significant move to shore up its defenses, network security giant Fortinet has released patches for eight vulnerabilities across its products, including two high-severity authentication bugs that could allow attackers to gain unauthorized access to sensitive systems. The company’s FortiWeb web application firewall and FortiManager management platform are among the affected products.
The most critical of these flaws is CVE-2026-26035, an improper authentication issue in FortiWeb that can be exploited by a remote, unauthenticated attacker to log into the system with a random username and password. This vulnerability is associated with the wildcard setting for administrator accounts, which is disabled by default but can be enabled by users who require it. When this feature is turned on, the system will match any username on a remote server with the Remote User account, effectively allowing an attacker to bypass traditional authentication mechanisms.
According to Fortinet, the weakness can only be exploited if the wildcard setting is enabled and the system is configured with specific, non-default settings. The company has patched this vulnerability in versions 8.0.3, 7.6.7, 7.4.12, and 7.2.13 of FortiWeb. To mitigate this issue, users are advised to disable the wildcard setting until a patch can be applied.
The second high-severity authentication flaw affects FortiManager, which is used to manage Fortinet’s FortiOS firewalls. CVE-2026-70468 is an authentication bypass issue that allows remote attackers to impersonate any FortiGate device managed by FortiManager. This requires a specific CLI option to be set and for the attacker to have a valid certificate. Fortinet has also patched this vulnerability, along with several other medium- and low-severity security defects in its products.
While it’s unclear whether these vulnerabilities have been exploited in the wild, users are urged to update their systems as soon as possible to prevent potential attacks. In light of this latest patch release, organizations that rely on Fortinet’s network security solutions should review their configurations and ensure that they have implemented all necessary security measures to minimize risk.
To stay ahead of emerging threats, it’s essential for IT administrators to regularly monitor their systems for updates and apply patches in a timely manner. By doing so, they can help protect against potential attacks and maintain the integrity of their network infrastructure.
Source: SecurityWeek — 2026-08-13