CVE-2026-70466 - Vulnerability Details

- Improper Access Control from Incomplete Disallowed Input Lists in FortiWeb

Description

A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via <insert attack vector here>

Published: 2026-08-12

Score: 4.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiWeb

unaffected

Version	Status	Constraints
`8.0.0`	affected	≤ 8.0.2
`7.6.0`	affected	≤ 7.6.5
`7.4.0`	affected	≤ 7.4.13
`7.2.0`	affected	≤ 7.2.13
`7.0.0`	affected	≤ 7.0.12

Fortinet

FortiOS

unaffected

Version	Status	Constraints
`7.6.0`	affected	≤ 7.6.7
`7.4.0`	affected	≤ 7.4.11
`7.2.0`	affected	≤ 7.2.13
`7.0.0`	affected	≤ 7.0.19
`6.4.0`	affected	≤ 6.4.16

No data.

Vendor Product Confidence Versions

Fortinet

Fortios

100%

Version	Status	Scheme	Platform
`[7.6.0,7.6.7]`	affected	semver	—
`[7.4.0,7.4.11]`	affected	semver	—
`[7.2.0,7.2.13]`	affected	semver	—
`[7.0.0,7.0.19]`	affected	semver	—
`[6.4.0,6.4.16]`	affected	semver	—

Fortinet

Fortiweb

100%

Version	Status	Scheme	Platform
`[8.0.0,8.0.2]`	affected	semver	—
`[7.6.0,7.6.5]`	affected	semver	—
`[7.4.0,7.4.13]`	affected	semver	—
`[7.2.0,7.2.13]`	affected	semver	—
`[7.0.0,7.0.12]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Upgrade to FortiWeb version 8.0.3 or above Upgrade to FortiWeb version 7.6.6 or above

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00309.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://fortiguard.fortinet.com/psirt/FG-IR-26-157

History

Thu, 13 Aug 2026 01:30:00 +0000

Type	Values Removed	Values Added
Title		Improper Access Control from Incomplete Disallowed Input Lists in FortiWeb

Wed, 12 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 12 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via <insert attack vector here>
First Time appeared		Fortinet Fortinet fortios Fortinet fortiweb
Weaknesses		CWE-184
CPEs		cpe:2.3:a:fortinet:fortiweb:7.0.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.10:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.11:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.12:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.5:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.6:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.7:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.8:::::::* cpe:2.3:a:fortinet:fortiweb:7.0.9:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.10:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.11:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.12:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.13:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.5:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.6:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.7:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.8:::::::* cpe:2.3:a:fortinet:fortiweb:7.2.9:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.10:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.11:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.12:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.13:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.5:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.6:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.7:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.8:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.9:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.5:::::::* cpe:2.3:a:fortinet:fortiweb:8.0.0:::::::* cpe:2.3:a:fortinet:fortiweb:8.0.1:::::::* cpe:2.3:a:fortinet:fortiweb:8.0.2:::::::* cpe:2.3:o:fortinet:fortios:6.4.0:::::::* cpe:2.3:o:fortinet:fortios:6.4.10:::::::* cpe:2.3:o:fortinet:fortios:6.4.11:::::::* cpe:2.3:o:fortinet:fortios:6.4.12:::::::* cpe:2.3:o:fortinet:fortios:6.4.13:::::::* cpe:2.3:o:fortinet:fortios:6.4.14:::::::* cpe:2.3:o:fortinet:fortios:6.4.15:::::::* cpe:2.3:o:fortinet:fortios:6.4.16:::::::* cpe:2.3:o:fortinet:fortios:6.4.1:::::::* cpe:2.3:o:fortinet:fortios:6.4.2:::::::* cpe:2.3:o:fortinet:fortios:6.4.3:::::::* cpe:2.3:o:fortinet:fortios:6.4.4:::::::* cpe:2.3:o:fortinet:fortios:6.4.5:::::::* cpe:2.3:o:fortinet:fortios:6.4.6:::::::* cpe:2.3:o:fortinet:fortios:6.4.7:::::::* cpe:2.3:o:fortinet:fortios:6.4.8:::::::* cpe:2.3:o:fortinet:fortios:6.4.9:::::::* cpe:2.3:o:fortinet:fortios:7.0.0:::::::* cpe:2.3:o:fortinet:fortios:7.0.10:::::::* cpe:2.3:o:fortinet:fortios:7.0.11:::::::* cpe:2.3:o:fortinet:fortios:7.0.12:::::::* cpe:2.3:o:fortinet:fortios:7.0.13:::::::* cpe:2.3:o:fortinet:fortios:7.0.14:::::::* cpe:2.3:o:fortinet:fortios:7.0.15:::::::* cpe:2.3:o:fortinet:fortios:7.0.16:::::::* cpe:2.3:o:fortinet:fortios:7.0.17:::::::* cpe:2.3:o:fortinet:fortios:7.0.18:::::::* cpe:2.3:o:fortinet:fortios:7.0.19:::::::* cpe:2.3:o:fortinet:fortios:7.0.1:::::::* cpe:2.3:o:fortinet:fortios:7.0.2:::::::* cpe:2.3:o:fortinet:fortios:7.0.3:::::::* cpe:2.3:o:fortinet:fortios:7.0.4:::::::* cpe:2.3:o:fortinet:fortios:7.0.5:::::::* cpe:2.3:o:fortinet:fortios:7.0.6:::::::* cpe:2.3:o:fortinet:fortios:7.0.7:::::::* cpe:2.3:o:fortinet:fortios:7.0.8:::::::* cpe:2.3:o:fortinet:fortios:7.0.9:::::::* cpe:2.3:o:fortinet:fortios:7.2.0:::::::* cpe:2.3:o:fortinet:fortios:7.2.10:::::::* cpe:2.3:o:fortinet:fortios:7.2.11:::::::* cpe:2.3:o:fortinet:fortios:7.2.12:::::::* cpe:2.3:o:fortinet:fortios:7.2.13:::::::* cpe:2.3:o:fortinet:fortios:7.2.1:::::::* cpe:2.3:o:fortinet:fortios:7.2.2:::::::* cpe:2.3:o:fortinet:fortios:7.2.3:::::::* cpe:2.3:o:fortinet:fortios:7.2.4:::::::* cpe:2.3:o:fortinet:fortios:7.2.5:::::::* cpe:2.3:o:fortinet:fortios:7.2.6:::::::* cpe:2.3:o:fortinet:fortios:7.2.7:::::::* cpe:2.3:o:fortinet:fortios:7.2.8:::::::* cpe:2.3:o:fortinet:fortios:7.2.9:::::::* cpe:2.3:o:fortinet:fortios:7.4.0:::::::* cpe:2.3:o:fortinet:fortios:7.4.10:::::::* cpe:2.3:o:fortinet:fortios:7.4.11:::::::* cpe:2.3:o:fortinet:fortios:7.4.1:::::::* cpe:2.3:o:fortinet:fortios:7.4.2:::::::* cpe:2.3:o:fortinet:fortios:7.4.3:::::::* cpe:2.3:o:fortinet:fortios:7.4.4:::::::* cpe:2.3:o:fortinet:fortios:7.4.5:::::::* cpe:2.3:o:fortinet:fortios:7.4.6:::::::* cpe:2.3:o:fortinet:fortios:7.4.7:::::::* cpe:2.3:o:fortinet:fortios:7.4.8:::::::* cpe:2.3:o:fortinet:fortios:7.4.9:::::::* cpe:2.3:o:fortinet:fortios:7.6.0:::::::* cpe:2.3:o:fortinet:fortios:7.6.1:::::::* cpe:2.3:o:fortinet:fortios:7.6.2:::::::* cpe:2.3:o:fortinet:fortios:7.6.3:::::::* cpe:2.3:o:fortinet:fortios:7.6.4:::::::* cpe:2.3:o:fortinet:fortios:7.6.5:::::::* cpe:2.3:o:fortinet:fortios:7.6.6:::::::* cpe:2.3:o:fortinet:fortios:7.6.7:::::::*
Vendors & Products		Fortinet Fortinet fortios Fortinet fortiweb
References		https://fortiguard.fortinet.com/psirt/FG-IR-26-157
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}`

Subscriptions

Fortinet Fortios Fortiweb

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2026-08-12T12:19:02.791Z

Updated: 2026-08-13T03:55:30.966Z

Reserved: 2026-08-04T15:01:42.010Z

Link: CVE-2026-70466

Vulnrichment

Updated: 2026-08-12T13:30:10.500Z

NVD

Status : Received

Published: 2026-08-12T13:17:24.883

Modified: 2026-08-13T05:17:26.077

Link: CVE-2026-70466

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-13T01:15:12Z

Weaknesses

CWE-184

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object