Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202608-00000012

Fortinet FortiWeb is a firewall product designed to protect web applications, with functions including anomaly detection, API protection, bot mitigation, and advanced threat analysis. Recently, Fortinet issued an advisory regarding a critical cybersecurity vulnerability (CVE-2026-26035, CVSS: 9.8). An improper authentication vulnerability exists in the administrator authentication configuration for FortiWeb using the remote RADIUS type. When certain non-default settings are used, an unauthenticated remote attacker may be able to log in to the FortiWeb GUI/CLI using a random username and password.