{"schema_version":1,"title":"Fortinet FortiWeb vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 7 vulnerabilities in Fortinet FortiWeb: 0 in the last 7 days and 0 in the last 90 days, 6 of them critical and 5 exploited in the wild. The most recent, CVE-2026-40688, was published on 14 April 2026.","url":"https://junglewise.ai/threats/technologies/fortiweb","json_url":"https://junglewise.ai/threats/technologies/fortiweb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/fortiweb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":7,"critical":6,"exploited":5,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":6},"latest":[{"cve":"CVE-2026-40688","cvss":7.2,"epss":0.0644,"slug":"cve-2026-40688-fortinet-fortiweb-out-of-bounds-write-in-cgi-daemon","title":"Fortinet FortiWeb out-of-bounds write in CGI daemon","severity":"high","exploited":false,"published_at":"2026-04-14T23:16:29.633+00:00","url":"https://junglewise.ai/threats/cve-2026-40688-fortinet-fortiweb-out-of-bounds-write-in-cgi-daemon"},{"cve":"CVE-2026-24858","cvss":9.8,"epss":0.048,"slug":"cve-2026-24858-fortinet-multiple-products-authentication-bypass-in-forticloud","title":"Fortinet Multiple Products authentication bypass in FortiCloud SSO","severity":"critical","exploited":true,"published_at":"2026-01-27T20:16:24.477+00:00","url":"https://junglewise.ai/threats/cve-2026-24858-fortinet-multiple-products-authentication-bypass-in-forticloud"},{"cve":"CVE-2025-59719","cvss":9.8,"epss":0.0026,"slug":"cve-2025-59719-fortinet-multiple-products-forticloud-sso-auth-bypass-via-saml","title":"Fortinet Multiple Products FortiCloud SSO auth bypass via SAML signature flaw","severity":"critical","exploited":false,"published_at":"2025-12-09T18:15:55.15+00:00","url":"https://junglewise.ai/threats/cve-2025-59719-fortinet-multiple-products-forticloud-sso-auth-bypass-via-saml"},{"cve":"CVE-2025-59718","cvss":9.8,"epss":0.0949,"slug":"cve-2025-59718-fortinet-multiple-products-auth-bypass-via-improper-saml","title":"Fortinet Multiple Products auth bypass via improper SAML signature verification","severity":"critical","exploited":true,"published_at":"2025-12-09T18:15:54.983+00:00","url":"https://junglewise.ai/threats/cve-2025-59718-fortinet-multiple-products-auth-bypass-via-improper-saml"},{"cve":"CVE-2025-58034","cvss":7.2,"epss":0.4264,"slug":"cve-2025-58034-fortinet-fortiweb-os-command-injection","title":"Fortinet FortiWeb OS command injection","severity":"critical","exploited":true,"published_at":"2025-11-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-58034-fortinet-fortiweb-os-command-injection"},{"cve":"CVE-2025-64446","cvss":9.8,"epss":0.9291,"slug":"cve-2025-64446-fortinet-fortiweb-path-traversal-and-command-execution","title":"Fortinet FortiWeb path traversal and command execution","severity":"critical","exploited":true,"published_at":"2025-11-14T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-64446-fortinet-fortiweb-path-traversal-and-command-execution"},{"cve":"CVE-2025-25257","cvss":9.8,"epss":0.2783,"slug":"cve-2025-25257-fortinet-fortiweb-sql-injection","title":"Fortinet FortiWeb SQL injection","severity":"critical","exploited":true,"published_at":"2025-07-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-25257-fortinet-fortiweb-sql-injection"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Fortinet FortiOS","slug":"fortios","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/fortios"},{"name":"Fortinet FortiProxy","slug":"fortiproxy","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/fortiproxy"},{"name":"Fortinet FortiPAM","slug":"fortipam","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/fortipam"},{"name":"Fortinet Fortisase","slug":"fortisase","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/fortisase"},{"name":"Fortinet FortiSwitchManager","slug":"fortiswitchmanager","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/fortiswitchmanager"},{"name":"Fortinet FortiADC","slug":"fortiadc","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/fortiadc"},{"name":"Fortinet FortiSandbox","slug":"fortisandbox","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/fortisandbox"},{"name":"Fortinet FortiProxy SSL-VPN","slug":"fortiproxy-ssl-vpn","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/fortiproxy-ssl-vpn"},{"name":"Fortinet FortiSandbox Cloud","slug":"fortisandbox-cloud","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/fortisandbox-cloud"},{"name":"Fortinet FortiGate NGFW","slug":"fortigate-ngfw","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/fortigate-ngfw"},{"name":"Fortinet FortiSandbox PaaS","slug":"fortisandbox-paas","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/fortisandbox-paas"},{"name":"Fortinet FortiClient EMS","slug":"forticlient-ems","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/forticlient-ems"}],"technology":{"hub":true,"name":"Fortinet FortiWeb","slug":"fortiweb","vendor":{"name":"Fortinet","slug":"fortinet","url":"https://junglewise.ai/threats/vendors/fortinet"},"aliases":[],"category":"web-application-firewall","homepage":"https://www.fortinet.com/products/web-application-firewall/fortiweb","description":"A web application firewall designed to protect hosted web applications from attacks and data breaches.","url":"https://junglewise.ai/threats/technologies/fortiweb"},"most_severe":[{"cve":"CVE-2025-64446","cvss":9.8,"epss":0.9291,"slug":"cve-2025-64446-fortinet-fortiweb-path-traversal-and-command-execution","title":"Fortinet FortiWeb path traversal and command execution","severity":"critical","exploited":true,"published_at":"2025-11-14T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-64446-fortinet-fortiweb-path-traversal-and-command-execution"},{"cve":"CVE-2025-25257","cvss":9.8,"epss":0.2783,"slug":"cve-2025-25257-fortinet-fortiweb-sql-injection","title":"Fortinet FortiWeb SQL injection","severity":"critical","exploited":true,"published_at":"2025-07-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-25257-fortinet-fortiweb-sql-injection"},{"cve":"CVE-2025-59718","cvss":9.8,"epss":0.0949,"slug":"cve-2025-59718-fortinet-multiple-products-auth-bypass-via-improper-saml","title":"Fortinet Multiple Products auth bypass via improper SAML signature verification","severity":"critical","exploited":true,"published_at":"2025-12-09T18:15:54.983+00:00","url":"https://junglewise.ai/threats/cve-2025-59718-fortinet-multiple-products-auth-bypass-via-improper-saml"},{"cve":"CVE-2026-24858","cvss":9.8,"epss":0.048,"slug":"cve-2026-24858-fortinet-multiple-products-authentication-bypass-in-forticloud","title":"Fortinet Multiple Products authentication bypass in FortiCloud SSO","severity":"critical","exploited":true,"published_at":"2026-01-27T20:16:24.477+00:00","url":"https://junglewise.ai/threats/cve-2026-24858-fortinet-multiple-products-authentication-bypass-in-forticloud"},{"cve":"CVE-2025-58034","cvss":7.2,"epss":0.4264,"slug":"cve-2025-58034-fortinet-fortiweb-os-command-injection","title":"Fortinet FortiWeb OS command injection","severity":"critical","exploited":true,"published_at":"2025-11-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-58034-fortinet-fortiweb-os-command-injection"},{"cve":"CVE-2025-59719","cvss":9.8,"epss":0.0026,"slug":"cve-2025-59719-fortinet-multiple-products-forticloud-sso-auth-bypass-via-saml","title":"Fortinet Multiple Products FortiCloud SSO auth bypass via SAML signature flaw","severity":"critical","exploited":false,"published_at":"2025-12-09T18:15:55.15+00:00","url":"https://junglewise.ai/threats/cve-2025-59719-fortinet-multiple-products-forticloud-sso-auth-bypass-via-saml"},{"cve":"CVE-2026-40688","cvss":7.2,"epss":0.0644,"slug":"cve-2026-40688-fortinet-fortiweb-out-of-bounds-write-in-cgi-daemon","title":"Fortinet FortiWeb out-of-bounds write in CGI daemon","severity":"high","exploited":false,"published_at":"2026-04-14T23:16:29.633+00:00","url":"https://junglewise.ai/threats/cve-2026-40688-fortinet-fortiweb-out-of-bounds-write-in-cgi-daemon"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}