CVE-2026-24641: 
Fortinet FortiWeb vulnerability analysis and mitigation

CVE-2026-24641 is a NULL Pointer Dereference vulnerability (CWE-476) in Fortinet FortiWeb's Anti-Defacement feature that allows an authenticated attacker to crash the HTTP daemon via crafted HTTP requests, resulting in denial of service. It affects FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, and all versions of FortiWeb 7.4, 7.2, and 7.0. The vulnerability was publicly disclosed on March 10, 2026, and was reported by Sina Kheirkhah (SinSinology) of watchTowr under responsible disclosure. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, though Fortinet's own advisory rates it as Low (CVSSv3 score of 2.5) (FortiGuard Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and resides in the GUI/HTTP daemon component of FortiWeb, specifically within the Anti-Defacement feature. An authenticated attacker can send specially crafted HTTP requests that trigger a null pointer dereference, causing the HTTP daemon process to crash. Exploitation requires network access and valid credentials with low-level privileges (CVSS PR:L), but no user interaction is needed. No public proof-of-concept code has been released (FortiGuard Advisory).

Successful exploitation results in a denial of service by crashing the FortiWeb HTTP daemon, disrupting the web application firewall's availability. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Organizations relying on FortiWeb for WAF protection could experience service interruptions, leaving protected web applications temporarily unguarded during the crash period (FortiGuard Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the time of disclosure. Fortinet's advisory confirms the vulnerability was discovered externally via responsible disclosure and is not known to be exploited. The EPSS score is approximately 0.074%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (FortiGuard Advisory).

Fortinet has released patched versions to address this vulnerability. Affected users should upgrade to the following fixed releases:

• FortiWeb 8.0.x: Upgrade to 8.0.3 or above
• FortiWeb 7.6.x: Upgrade to 7.6.7 or above
• FortiWeb 7.4, 7.2, 7.0: Migrate to a fixed release (no in-branch fix available)

As a compensating control, administrators should restrict access to the FortiWeb management interface to trusted IP addresses and limit high-privilege account usage. Patching should be scheduled within normal maintenance windows given the low severity rating (FortiGuard Advisory).

The vulnerability was reported by Sina Kheirkhah (SinSinology) of watchTowr under responsible disclosure, and Fortinet acknowledged the researcher in its advisory. No significant broader media coverage or notable community debate has been observed, consistent with the low severity rating and absence of active exploitation (FortiGuard Advisory).