CVE-2026-24017 Security feature bypass in FortiWeb
Remote attackers can bypass authentication rate limits in FortiWeb, facilitating brute-force attacks against user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24017?
CVE-2026-24017 is a high-severity vulnerability in Fortinet Fortiweb, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password target complexity.
Weakness: CWE-799
Which versions are affected by CVE-2026-24017?
It affects 1 product.
Products include Fortinet Fortiweb.
How do I fix CVE-2026-24017?
No fix has been published for CVE-2026-24017 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-24017 being exploited?
There is no known exploitation of CVE-2026-24017 in the wild and no public exploit code.
Other vulnerabilities in Fortinet Fortiweb
Sources
Also known as GHSA-76jh-wm3g-gchp.