CVE-2026-26035 — FortiWeb: one non-default RADIUS admin setting turns any username and password into a valid GUI/CLI login, alongside an FGFM impersonation bug and a FortiClient flaw reachable by anyone who can answer a laptop's DNS
Fortinet issued patches for eight vulnerabilities across its products on 2026-08-12 (SecurityWeek, 2026-08-13). Four of the flaws in that batch matter to a defender's next week. The most consequential is CVE-2026-26035 (CVSS 8.8, CWE-287): where FortiWeb's Remote RADIUS Type Admin authentication is configured with specific, non-default settings, a remote unauthenticated attacker can log into the FortiWeb GUI or CLI with a random username and password (Fortinet PSIRT, 2026-08-12). The setting in question is named in the advisory's own workaround: the Wildcard option on a Remote Type administrator account, reached in the GUI under System > Administrators. The affected branches, read from Fortinet's CSAF record rather than the advisory's rendered table, are FortiWeb 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12 and 7.0.0 through 7.0.12. Released fixes exist for three of those five: 8.0.3, 7.6.7 and 7.4.12. The 7.2 and 7.0 branches are answered only by builds the record marks as upcoming — 7.2.13 and 7.0.13 — so an estate on either has no patch to install today and the Wildcard configuration check is its whole remediation.
CVE-2026-70468 (CVSS 7.3, CWE-288) is the management-plane counterpart: a remote unauthenticated attacker holding a valid certificate can impersonate any FortiGate managed by a FortiManager that has a specific CLI option set, via crafted FGFM protocol requests (Fortinet PSIRT, 2026-08-12). The option is fgfm-peercert-withoutsn, and disabling it is the vendor's stated workaround. Affected are FortiManager 7.6.1, 7.4.3 through 7.4.5 and 7.2.5 through 7.2.9 plus the corresponding FortiManager Cloud versions, fixed in 7.6.2, 7.4.6 and 7.2.10; FortiManager 8.0 is listed as not affected. CVE-2026-70466 (CVSS 4.8, CWE-184) is an incomplete list of disallowed inputs in the FortiWeb WAF that lets an unauthenticated attacker bypass policies via specifically crafted requests (Fortinet PSIRT, 2026-08-12) — a lower score, but a WAF that can be walked past is a compensating control that has stopped compensating. Its version data is the one to read carefully: 8.0.0 through 8.0.2 are answered by 8.0.3 and 7.6.0 through 7.6.5 by 7.6.6, but the 7.4, 7.2 and 7.0 branches are all listed as affected at every version with no fixed build at all — migration is the only remediation, and Fortinet offers an interim virtual patch, FG-VD-10009598.0day, in FortiWeb signature database update FMWP 26.071 — the concrete lever for the three branches with no fixed build.
The fourth flaw in the batch is the one that reaches past the data centre. CVE-2026-70465 (CVSS 7.3, CWE-120) is a buffer copy without checking the size of input in FortiClient for Windows that "may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets" (Fortinet PSIRT, 2026-08-12). The precondition is not a credential but a network position: anyone able to answer the endpoint's DNS queries — a hostile or compromised local network, a captive portal, an on-path attacker upstream of a home or hotel connection — can reach the code path. That is precisely the position a remote-working laptop puts itself in every time it joins an untrusted network before the VPN comes up, which makes this a teleworker-fleet problem rather than a server-patching one. FortiClient for Windows 7.4.0 through 7.4.3 upgrade to 7.4.4 and 7.2.0 through 7.2.11 upgrade to 7.2.12; the 8.0 branch is not affected. Fortinet's stated workaround is to disable application-based filtering in the FortiClient EMS remote-access profile's VPN tunnel settings. SecurityWeek notes Fortinet makes no mention of any of these vulnerabilities being exploited in the wild (SecurityWeek, 2026-08-13).
None of them is reported exploited: SecurityWeek records that Fortinet makes no mention of any of these vulnerabilities being exploited in the wild. What lifts them above the ordinary patch queue is that two of them are configuration-gated, which cuts both ways: an estate that never enabled the Wildcard option or fgfm-peercert-withoutsn is not exposed at all and needs only a routine upgrade, while one that did is exposed right now and can close the hole today with a settings change rather than a maintenance window. That makes the first task an inventory question, not a patching question — and it is answerable in minutes across a fleet. The certificate precondition on the FortiManager bug is worth reading precisely: it does not say a certificate issued to the impersonated FortiGate, and the advisory's own framing is an alternate-path authentication bypass, so a defender should treat any valid certificate the deployment would accept as sufficient rather than assuming device-specific binding.
Detection concepts, telemetry class first: in administrative authentication logs on FortiWeb, a successful GUI or CLI admin login for a username that does not exist in the backing RADIUS directory is the signature of this bypass being used — the login succeeds locally, so the discriminator is the mismatch between the accepted account and the identity store that was supposed to authorise it. In management-fabric telemetry on FortiManager, watch for FGFM session establishment from a source presenting a certificate whose subject does not correspond to the device serial the session claims, and for a managed FortiGate appearing to check in from an unexpected address or twice from different sources. Fortinet edge and management products have a sustained recent history of rapid post-disclosure weaponisation — this pipeline recorded a Gunra ransomware campaign abusing older FortiOS authentication-bypass flaws for initial access four days ago — so the interval between a published advisory and a working exploit is the planning assumption here, not the absence of exploitation today.
An Improper Authentication vulnerability [CWE-287] in the FortiWeb Remote Radius Type Admin Authentication configured with specific, non-default settings may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password
An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests if the attacker has a valid certificate.
A buffer copy without checking size of input vulnerability [CWE-120] in FortiClient Windows may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.
Defender actions
- Upgrade FortiClient for Windows to 7.4.4 or 7.2.12 across the remote-working fleet, or disable application-based filtering in the EMS remote-access profile's VPN tunnel settings in the meantime — the flaw needs no credential, only an attacker positioned to answer the endpoint's DNS, which is the normal condition of a laptop on an untrusted network before the tunnel comes up.
- Check whether the Wildcard option is enabled on any FortiWeb Remote Type administrator account (System > Administrators) and disable it — this is Fortinet's own workaround for CVE-2026-26035 and it removes the exposure without waiting for a maintenance window, ahead of upgrading to 8.0.3, 7.6.7 or 7.4.12. On the 7.2 and 7.0 branches that configuration change is the whole remediation for now, because their fixed builds are listed as upcoming rather than released.
- Check whether fgfm-peercert-withoutsn is set on any FortiManager or FortiManager Cloud instance and disable it, then upgrade to 7.6.2 / 7.4.6 / 7.2.10 — with the option set, a valid certificate is enough to impersonate a managed FortiGate over FGFM.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Credential Access TA0006
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Collection TA0009
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.