Back www.fortiguard.com

FG IR 25 910

www.fortiguard.com • June 17, 2026

A relative path traversal vulnerability [CWE-23] in FortiWeb may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Fortinet has observed this to be exploited in the wild

FortiAppSec Cloud is NOT impacted by this vulnerability.

Disable HTTP or HTTPS for internet facing interfaces. Fortinet recommends taking this action until an upgrade can be performed. If the HTTP/HTTPS Management interface is internally accessible only as per best practice, the risk is significantly reduced.

It is recommended that customers review their configuration for and review logs for unexpected modifications, or the addition of unauthorized administrator accounts.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiWeb Vulnerabilities Exploited: Path Traversal and OS Command Injection Two vulnerabilities in FortiWeb have been identified, both exploited in the wild. The first, a relative path traversal vulnerability (CWE-23), allows unauthenticated attackers to execute administrative commands via crafted HTTP or HTTPS requests. The second, an OS command injection vulnerability (CWE-78), enables authenticated attackers to execute unauthorized code through crafted HTTP requests or CLI commands. Both vulnerabilities affect FortiWeb systems but do not impact FortiAppSec Cloud. Fortinet recommends disabling HTTP/HTTPS for internet-facing interfaces as a temporary mitigation until upgrades can be performed. Customers are advised to review their configurations and logs for unauthorized changes. Immediate action is necessary to prevent exploitation. 73

FG IR 25 910

The full story

Extracted Entities

Platforms (1)

Vulnerabilities (2)