GCVE-110-NCSC-2026-92

Advisory PublishedCVSS 5.3/10

Vulnetix · Advisory published March 12, 2026

A vulnerability in Fortinet FortiWeb versions 7.0 through 7.6.3 enables remote unauthenticated attackers to bypass hostname restrictions by spoofing authentication using specially crafted requests.

Download JSON Open in Console

Weaknesses (CWE)

CWE-290Authentication Bypass by SpoofingCWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-799Improper Control of Interaction FrequencyCWE-121Stack-based Buffer OverflowCWE-476NULL Pointer Dereference

Risk Scores

CVSS 3.1

5.3/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C

Affected Products

Vendor	Product	Versions	Platforms
Fortinet	vers:unknown/*	—	—

Aliases

CVE-2025-48840 CVE-2025-66178 CVE-2026-24017 CVE-2026-24640 CVE-2026-24641 CVE-2026-30897

References

advisory

Browse GCVE Records

73,685 records in the GCVE database · Updated July 18, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON