← News
/DISPATCH · 2026-08-15

CVE-2026-26035: FortiWeb Remote RADIUS Wildcard Enables Unauthenticated Login; FortiManager/FortiClient Concurrent High-Severity Flaws

Fortinet patched multiple high-severity flaws in FortiWeb, FortiManager, and FortiClient on 12-13 August. CVE-2026-26035 lets an unauthenticated attacker log into the WAF admin UI with any password when Remote RADIUS wildcards are enabled.

Fortinet shipped concentrated security updates on 12-13 August covering FortiWeb, FortiManager, FortiClient, and FortiOS. Most severe: FortiWeb CVE-2026-26035 (CVSS 9.6/9.8, config-dependent). With Remote RADIUS wildcards enabled, an unauthenticated remote attacker can log into the WAF admin UI with any username and password. Same window patched FortiManager FGFM protocol auth bypass CVE-2026-70468 and FortiClient for Windows buffer overflow CVE-2026-70465. HKCERT rated the batch medium risk; actual impact of a single-point RCE path plus management-plane compromise far exceeds that rating.

Incident Overview

SecurityWeek, HKCERT, and FortiGuard PSIRT concurrently disclosed multiple high-severity authentication and RCE flaws in FortiWeb / FortiManager / FortiClient. FortiWeb CVE-2026-26035 fires when a Remote Type admin account has admin wildcard enabled; the attacker needs no credentials to reach the WAF GUI. FortiManager CVE-2026-70468 sits in the FGFM protocol: an attacker with a valid certificate and CLI config can impersonate a managed FortiGate and change firewall policy. FortiClient for Windows CVE-2026-70465 is a high-severity buffer overflow triggered by crafted or spoofed DNS responses — direct RCE on the Windows endpoint. No in-the-wild exploitation reported. SecurityWeek lists the FortiWeb wildcard auth flaw as an immediate patch target.

FG-IR-26-156 through FG-IR-26-162 — seven FortiGuard advisories in one drop — is among Fortinet's densest single disclosure windows of 2026.

Technical Details

CVE-2026-26035 trigger: Remote Type admin account with admin wildcard enabled. The feature allows wildcard matching on usernames during RADIUS validation; it is not default. Once enabled, the auth path does not strictly validate the username field in the RADIUS response. Attacker submits any username and password and obtains a FortiWeb admin session.

CVE-2026-70468 lives in the FGFM protocol between FortiManager and FortiGate. Given a valid certificate and CLI config, an attacker can impersonate another FortiGate and push policy. Hits multi-device central-management deployments.

CVE-2026-70465 is a FortiClient for Windows buffer overflow. Trigger path: crafted or MITM-spoofed DNS response. Endpoint user does not need to visit a malicious site.

Impact

FortiWeb is the external WAF core. Bypass exposes every application it protects. CVE-2026-26035 needs no authentication, no user interaction — only network reachability to the FortiWeb management port. One of the highest single-point Fortinet auth-bypass impacts of 2026.

FortiManager FGFM has wider blast radius. Any organization using FortiManager to centrally manage FortiGate clusters faces policy-tampering risk: bulk ACL disable, rogue routes, IPS signature changes.

FortiClient RCE extends impact to every Windows endpoint running FortiClient. FortiWeb / FortiManager / FortiClient as a combined stack is a common mid-to-large enterprise deployment in China. Patch all three.

Remediation

References