CVE-2026-39814
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Multiple Relative Path Traversal vulnerabilities [CWE-23] in Fortinet FortiWeb may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands.
Risk Assessment
A privileged local attacker may execute unauthorized code, potentially compromising the integrity of the FortiWeb system.
Recommendation
Update FortiWeb to a patched version and restrict privileged local access to the device.
Other vulnerabilities in FortiWeb
See all- CVE-2026-26035Critical
An Improper Authentication vulnerability (CWE-287) in Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password.
- CVE-2026-40688High
An out-of-bounds write vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11 allows a remote privileged attacker to execute arbitrary code or commands via crafted HTTP requests.
- CVE-2025-64447High
FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11 rely on cookies without validation and integrity checking. An unauthenticated attacker may execute arbitrary operations on the system via crafted HTTP or HTTPS requests using forged cookies, requiring prior knowledge of the FortiWeb serial number.
- CVE-2025-58034HighActively exploited
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
- CVE-2026-70466Medium
Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.5, 7.4 (all), 7.2 (all), and 7.0 (all) have an incomplete list of disallowed inputs vulnerability, which may allow an attacker to cause improper access control.
- CVE-2025-66178High
An OS command injection vulnerability in Fortinet FortiWeb (versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12) stems from improper neutralization of special elements in OS commands. An authenticated attacker may execute arbitrary commands via a specially crafted HTTP request.
- CVE-2025-64471Medium
A use of password hash instead of password for authentication vulnerability [CWE-836] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests.
- CVE-2025-59669Medium
Fortinet FortiWeb versions 7.6.0, 7.4, 7.2, and 7.0 contain a use of hard-coded credentials vulnerability. An authenticated attacker with shell access can connect to the Redis service and access its data.
Original NVD description (English source)
Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.13, FortiWeb 7.2.7 through 7.2.13, FortiWeb 7.0.10 through 7.0.12 may allow a local privileged attacker to execute unauthorized code on the underlying system via crafted CLI commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS