Incomplete Input Validation Vulnerability in Fortinet FortiWeb Products
CVE-2026-70466

4.8MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortiweb
FortiOS
Vendor
CVE Published:
12 August 2026

What is CVE-2026-70466?

An incomplete list of disallowed inputs vulnerability exists in Fortinet FortiWeb products across various versions. This flaw may allow attackers to bypass access controls, potentially leading to unauthorized access or data exposure. Versions from 8.0.0 to 8.0.2, as well as earlier versions down to 7.0, are susceptible to this issue. It is crucial for users to assess their systems and apply any available patches or mitigations to protect against potential exploitation.

Affected Version(s)

FortiOS 7.6.0 <= 7.6.7

FortiOS 7.4.0 <= 7.4.11

FortiOS 7.2.0 <= 7.2.13

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-157

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.