Back fortiguard.fortinet.com

FG IR 26 157

fortiguard.fortinet.com • August 13, 2026

An incomplete list of disallowed inputs [CWE-184] in FortiWeb WAF may allow an unauthenticated attacker to bypass policies via specifically crafted requests.

Virtual Patch named "FG-VD-10009598.0day." is available in FMWP db update 26.071.

2026-08-12: Initial publication

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Fortinet Products Two vulnerabilities have been identified in Fortinet products affecting FortiOS and FortiWeb. The first, a stack-based buffer overflow in FortiOS explicit proxy, allows unauthenticated attackers to execute arbitrary code if Kerberos authentication and SOCKS are enabled. The second vulnerability in FortiWeb WAF permits attackers to bypass security policies through crafted requests due to an incomplete list of disallowed inputs. Both vulnerabilities were published on August 12, 2026, and have associated virtual patches available. Security professionals are advised to disable the SOCKS proxy and modify authentication schemes for FortiOS, while also applying the virtual patch for FortiWeb. No active exploitation has been reported yet, but the vulnerabilities pose significant risks if left unaddressed. 58

Extracted Entities

FG IR 26 157

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)