CVE-2026-70466: 
FortiOS Analisi e mitigazione delle vulnerabilità

CVE-2026-70466 is a medium-severity vulnerability classified as an Incomplete List of Disallowed Inputs (CWE-184) in Fortinet FortiWeb's Web Application Firewall (WAF) component, enabling unauthenticated attackers to bypass WAF policies via specially crafted requests. It affects FortiWeb versions 8.0.0–8.0.2, 7.6.0–7.6.5, 7.4 all versions (up to 7.4.13), 7.2 all versions (up to 7.2.13), and 7.0 all versions (up to 7.0.12). The vulnerability was publicly disclosed on August 12, 2026, and was reported by Rui Xi (@Cycloctane) from Beijing University of Posts and Telecommunications under responsible disclosure. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, and 4.8 (Medium) per Fortinet's own advisory (Fortinet PSIRT, GitHub Advisory).

The root cause is an incomplete denylist (CWE-184) in FortiWeb's WAF engine that fails to account for certain content-encoding or input obfuscation techniques, allowing malicious requests to evade policy enforcement. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it automatable. Exploitation likely involves crafting HTTP requests that use encoding or delimiter techniques (e.g., double encoding, Unicode encoding, argument injection) that are not covered by FortiWeb's input filter rules, thereby bypassing WAF protections. The Fortinet advisory specifically titles this issue "Content-Encoding WAF Evasion," indicating the bypass is achieved through manipulated content-encoding in HTTP requests (Fortinet PSIRT, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass FortiWeb WAF policies, potentially enabling downstream attacks against web applications that rely on FortiWeb for protection. The primary impact is an integrity compromise — attackers can modify application data or settings by sending requests that would otherwise be blocked by WAF rules. Confidentiality and availability are not directly impacted by this vulnerability itself, though bypassing WAF protections could facilitate further attacks (e.g., SQL injection, XSS) against protected backend applications (Fortinet PSIRT).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date (Fortinet PSIRT). The vulnerability is rated as automatable by NVD SSVC analysis, meaning exploitation could be scripted at scale. The EPSS score is 0.0, reflecting very low current probability of exploitation in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and Fortinet's advisory confirms it is not known to be exploited (Fortinet PSIRT, GitHub Advisory).

1. Reconnaissance: Identify internet-facing FortiWeb WAF instances running affected versions (8.0.0–8.0.2, 7.6.0–7.6.5, 7.4.x, 7.2.x, 7.0.x) using tools like Shodan or Censys, or by probing HTTP response headers that reveal FortiWeb presence.
2. Identify protected application endpoints: Map the web application endpoints protected by the FortiWeb WAF that would normally block malicious payloads (e.g., endpoints vulnerable to SQLi or XSS).
3. Craft evasion payload: Construct HTTP requests using content-encoding techniques not covered by FortiWeb's denylist — such as double URL encoding, Unicode encoding variants, or non-standard content-encoding headers — to obfuscate attack payloads.
4. Bypass WAF policy: Submit the crafted request to the FortiWeb-protected endpoint; the incomplete input filter fails to recognize the encoded malicious input, allowing the request to pass through to the backend application.
5. Achieve objective: With WAF protections bypassed, deliver the underlying attack payload (e.g., injection attack) to the backend application to achieve the attacker's goal (Fortinet PSIRT).

• Network: HTTP requests to FortiWeb-protected endpoints containing unusual or non-standard content-encoding headers (e.g., unexpected Content-Encoding values); requests with double-encoded or Unicode-encoded characters in parameters that would normally trigger WAF blocks.
• Logs: FortiWeb access logs showing requests with encoded payloads that passed through without triggering WAF policy violations; absence of expected WAF block events for known attack patterns against protected applications.
• Application Logs: Backend application logs showing attack patterns (e.g., SQL injection strings, XSS payloads) that should have been blocked by the WAF, indicating successful bypass.

Fortinet has released patched versions: FortiWeb 8.0.3 or above (for 8.0.x users) and FortiWeb 7.6.6 or above (for 7.6.x users). Users on FortiWeb 7.4, 7.2, or 7.0 branches must migrate to a fixed release as no in-branch fix is available for those versions. As an interim virtual patch, Fortinet has made a virtual patch named "FG-VD-10009598.0day" available in FMWP database update 26.071, which can be applied without upgrading the FortiWeb firmware. Organizations unable to patch immediately should implement network segmentation to restrict access to FortiWeb management interfaces and review WAF logs for anomalous bypass activity (Fortinet PSIRT).

The vulnerability was responsibly disclosed by Rui Xi (@Cycloctane) from Beijing University of Posts and Telecommunications, and Fortinet acknowledged the researcher in their advisory. Community tracking sites including VulDB and Vulners indexed the CVE shortly after disclosure. No significant media coverage or notable researcher commentary beyond the initial disclosure has been observed as of the publication date (Fortinet PSIRT).