CVE-2026-70466 Overview
CVE-2026-70466 is an incomplete list of disallowed inputs vulnerability [CWE-184] affecting multiple versions of Fortinet FortiWeb. The flaw stems from an incomplete deny list that permits an attacker to bypass access controls over the network without authentication. Successful exploitation may lead to improper access control with limited impact to integrity, according to the associated CVSS metrics.
Fortinet published the issue through PSIRT advisory FG-IR-26-157. The vulnerability affects FortiWeb 8.0.0 through 8.0.2, 7.6.0 through 7.6.5, and all versions of the 7.4, 7.2, and 7.0 branches.
Critical Impact
An unauthenticated remote attacker can bypass FortiWeb input filtering to influence protected resources, undermining the web application firewall's access control guarantees.
Affected Products
- Fortinet FortiWeb 8.0.0 through 8.0.2
- Fortinet FortiWeb 7.6.0 through 7.6.5
- Fortinet FortiWeb 7.4, 7.2, and 7.0 (all versions)
Discovery Timeline
- 2026-08-12 - CVE CVE-2026-70466 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-70466
Vulnerability Analysis
The vulnerability is classified under CWE-184: Incomplete List of Disallowed Inputs. FortiWeb enforces access control by matching requests against a defined set of disallowed values. Because that list is incomplete, an attacker can craft requests that evade the filter while still reaching protected functionality.
This category of weakness typically arises when a product relies on a deny list rather than an allow list. Any input variant not enumerated in the deny list passes validation, even when it produces the same protected behavior. In the context of a web application firewall, the consequence is that the security control designed to block malicious traffic can be circumvented at the perimeter.
The network-accessible attack surface and lack of authentication requirement widen the potential exposure of any FortiWeb appliance reachable from untrusted networks.
Root Cause
The root cause is an insufficient enumeration of disallowed inputs within FortiWeb's request processing logic. The filtering routine does not account for all input encodings, casings, or equivalents that map to the same protected operation, allowing selected requests to pass validation.
Attack Vector
An attacker sends specially crafted HTTP or HTTPS requests to a vulnerable FortiWeb instance over the network. No authentication or user interaction is required. The requests are structured to match forms of input that the deny list fails to cover, resulting in improper access to the protected resource or function.
Fortinet has not published a public proof-of-concept for CVE-2026-70466. Technical specifics are described in the Fortinet PSIRT Advisory FG-IR-26-157.
Detection Methods for CVE-2026-70466
Indicators of Compromise
- Unexpected HTTP requests to FortiWeb management or protected endpoints that use unusual encodings, mixed case, or non-standard character sequences.
- Access log entries showing successful responses to requests that would normally be blocked by FortiWeb policy.
- Sudden changes to FortiWeb policy state, configuration, or user objects without a corresponding authenticated administrator session.
Detection Strategies
- Enable verbose HTTP request logging on FortiWeb and forward logs to a centralized SIEM for correlation.
- Baseline normal administrative and API traffic patterns, then alert on deviations such as requests from unfamiliar source addresses.
- Compare inbound request payloads against known bypass patterns documented in Fortinet advisory FG-IR-26-157.
Monitoring Recommendations
- Continuously monitor FortiWeb version and build against the fixed releases listed by Fortinet.
- Track outbound connections from FortiWeb appliances to detect follow-on activity after a bypass.
- Review administrative action audit trails daily for changes that lack a matching authenticated session.
How to Mitigate CVE-2026-70466
Immediate Actions Required
- Identify all FortiWeb appliances in the environment and confirm the running firmware version.
- Restrict network exposure of FortiWeb management and API interfaces to trusted administrative networks only.
- Apply the fixed firmware release identified in Fortinet PSIRT advisory FG-IR-26-157 as soon as validated.
Patch Information
Fortinet has documented the affected versions and remediation guidance in Fortinet PSIRT Advisory FG-IR-26-157. Administrators should upgrade FortiWeb to a build that Fortinet lists as containing the fix for CVE-2026-70466.
Workarounds
- Place FortiWeb management interfaces behind a VPN or jump host and block direct internet access.
- Apply strict source IP allow lists on trusted-host configuration for administrative access.
- Increase logging and alerting on FortiWeb request-handling components until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
