CVE-2026-40688

HighCVSS 7.2

Published: 14/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.44%

93th percentile - higher than 93% of all known CVEs

Summary

An out-of-bounds write vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11 allows a remote privileged attacker to execute arbitrary code or commands via crafted HTTP requests.

Risk Assessment

A privileged attacker could take control of the FortiWeb system by executing arbitrary code or commands.

Recommendation

Update FortiWeb to a patched version (e.g., 8.0.4 or later).

Original NVD description (English source)

An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests.