CVE-2026-24017
Authentication Rate-Limit Bypass in Fortinet FortiWeb via Improper Interaction Control
Publication date: 2026-03-10
Last updated on: 2026-03-12
Assigner: Fortinet, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortiweb | From 7.0.0 (inc) to 7.0.12 (exc) |
| fortinet | fortiweb | From 7.2.0 (inc) to 7.2.12 (exc) |
| fortinet | fortiweb | From 7.4.0 (inc) to 7.4.11 (exc) |
| fortinet | fortiweb | From 7.6.0 (inc) to 7.6.6 (exc) |
| fortinet | fortiweb | From 8.0.0 (inc) to 8.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-799 | The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Control of Interaction Frequency (CWE-799) found in Fortinet FortiWeb versions 7.0.0 through 8.0.2. It allows a remote unauthenticated attacker to bypass the authentication rate-limit by sending specially crafted requests. Essentially, the system's mechanism to limit the number of authentication attempts can be circumvented, potentially enabling an attacker to try many password guesses without being blocked.
How can this vulnerability impact me? :
The vulnerability can have a significant impact as it allows an attacker to bypass authentication rate-limiting controls remotely without authentication. This can lead to successful brute-force attacks against user passwords, potentially resulting in unauthorized access. The severity is high, with impacts on confidentiality, integrity, and availability, as indicated by the CVSS score of 8.1.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know