CVE-2026-26035 is an improper authentication vulnerability (CWE-287) affecting Fortinet FortiWeb versions 7.0.0 to 7.0.12, 7.2.0 to 7.2.12, 7.4.0 to 7.4.11, 7.6.0 to 7.6.6, and 8.0.0 to 8.0.2. This flaw allows a remote attacker without any prior authentication to successfully log in to the FortiWeb management interfaces (GUI/CLI) by supplying random usernames and passwords, bypassing normal authentication controls. The vulnerability is rated high severity with a CVSS v3.1 score of 8.8, reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Fortinet has released official patches addressing this issue.

Successful exploitation of this vulnerability allows a remote unauthenticated attacker to gain administrative access to the FortiWeb device's management interfaces. This can lead to full compromise of the affected system, including unauthorized configuration changes, data exposure, and disruption of service. The high CVSS score indicates critical impact on confidentiality, integrity, and availability.

An official fix is available from Fortinet for this vulnerability. Users should apply the vendor-provided patches to affected FortiWeb versions promptly to remediate the issue. Since the vulnerability allows unauthenticated access, applying the patch is critical to prevent unauthorized administrative access.