Fortinet patched eight vulnerabilities including two high-severity authentication flaws in FortiWeb and FortiManager. CVE-2026-26035 in FortiWeb allows remote unauthenticated login via a wildcard administrator account setting, which is disabled by default but can be enabled to match any username on a remote server. This flaw was fixed in FortiWeb versions 8.0.3, 7.6.7, 7.4.12, and 7.2.13. CVE-2026-70468 in FortiManager is an authentication bypass that enables remote attackers with a valid certificate and a specific CLI option set to impersonate any FortiGate device managed by FortiManager. Fortinet also patched other vulnerabilities including a buffer overflow in FortiClient for Windows. No active exploitation has been observed. Fortinet advises disabling the wildcard setting in FortiWeb as a mitigation.

Successful exploitation of CVE-2026-26035 could allow unauthenticated remote attackers to gain unauthorized access to the FortiWeb GUI or CLI by logging in with arbitrary usernames and passwords when the wildcard administrator setting is enabled. CVE-2026-70468 could enable attackers with a valid certificate and specific CLI configuration to impersonate any FortiGate device managed by FortiManager, potentially leading to unauthorized device management actions. These vulnerabilities could compromise authentication integrity and administrative control over affected Fortinet products.

Fortinet has released official patches for the affected FortiWeb and FortiManager versions. Users should apply these patches promptly. As a temporary workaround for CVE-2026-26035, disabling the wildcard administrator account setting in FortiWeb is recommended. For CVE-2026-70468, ensure that the specific CLI option enabling the vulnerability is not set unless necessary and that certificate management is strictly controlled. No additional mitigation is required beyond applying the vendor patches and following their guidance.