CVE-2026-24017
Received
Received - Intake
Authentication Rate-Limit Bypass in Fortinet FortiWeb via Improper Interaction Control
Vulnerability report for CVE-2026-24017, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-03-10
Last updated on: 2026-03-12
Assigner: Fortinet, Inc.
Description
Description
An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password target complexity.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortiweb | From 7.0.0 (inc) to 7.0.12 (exc) |
| fortinet | fortiweb | From 7.2.0 (inc) to 7.2.12 (exc) |
| fortinet | fortiweb | From 7.4.0 (inc) to 7.4.11 (exc) |
| fortinet | fortiweb | From 7.6.0 (inc) to 7.6.6 (exc) |
| fortinet | fortiweb | From 8.0.0 (inc) to 8.0.3 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-799 | The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. |
