← Back

CVE-2026-24017

nvd nist
Published: Mar 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: psirt@fortinet.com (Secondary)

Description

An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password target complexity.

Affected (5)

Products: Fortinet: Fortiweb
Fortinet
1 product
Fortiweb
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiweb
From 7.0.0 to 7.0.12
Fortiweb
From 7.2.0 to 7.2.12
Fortiweb
From 7.4.0 to 7.4.11
Fortiweb
From 7.6.0 to 7.6.6
Fortiweb
From 8.0.0 to 8.0.3

Related CWEs

CWE-799
Improper Control of Interaction Frequency
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.