PT-2026-24250 · Fortinet · Fortiweb

Published 2026-03-10 · Updated 2026-03-18 · CVE-2026-30897

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 7.0 through 7.2 Fortinet FortiWeb versions 7.4.0 through 7.4.11 Fortinet FortiWeb versions 7.6.0 through 7.6.6 Fortinet FortiWeb versions 8.0.0 through 8.0.3

Description A stack-based buffer overflow exists in Fortinet FortiWeb. Successful exploitation may allow a remote authenticated attacker to bypass stack protection and Address Space Layout Randomization (ASLR) and execute arbitrary code or commands via crafted HTTP requests. The vulnerability is triggered by specially crafted HTTP requests that cause a buffer overflow on the stack.

Recommendations FortiWeb versions 7.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiWeb versions 7.2: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiWeb versions 7.4.0 through 7.4.11: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiWeb versions 7.6.0 through 7.6.6: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiWeb versions 8.0.0 through 8.0.3: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2026-03218

CVE-2026-30897

Affected Products

Fortiweb

References · 6

• https://fortiguard.fortinet.com/psirt/FG-IR-26-093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30897 · Security Note
• https://bdu.fstec.ru/vul/2026-03218 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30897 · Vendor Advisory
• https://t.me/cveNotify/155321 · Telegram Post
• https://twitter.com/CVEnew/status/2034136483045560541 · Twitter Post