PT-2026-24246 · Fortinet · Fortiweb

J. Liu + 1 · Published 2026-03-10 · Updated 2026-03-17 · CVE-2026-24641

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 7.0 through 8.0.2 Fortinet FortiWeb version 7.2 Fortinet FortiWeb version 7.4 Fortinet FortiWeb versions 7.6.0 through 7.6.6 Fortinet FortiWeb version 8.0

Description The software contains a NULL pointer dereference issue [CWE-476]. An authenticated attacker can potentially cause the HTTP daemon to crash by sending specially crafted HTTP requests. The issue affects multiple major versions of the software.

Recommendations FortiWeb versions prior to 8.0.2 are affected.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-03215

CVE-2026-24641

Affected Products

Fortiweb

References · 8

• https://fortiguard.fortinet.com/psirt/FG-IR-26-089 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24641 · Security Note
• https://bdu.fstec.ru/vul/2026-03215 · Security Note
• https://twitter.com/0dayPublishing/status/2032104092860907574 · Twitter Post
• https://twitter.com/CVEnew/status/2033994309553492073 · Twitter Post
• https://t.me/cveNotify/155359 · Telegram Post
• https://twitter.com/dailycve/status/2032276261360325013 · Twitter Post