ZDI-26-265: Fortinet FortiWeb cgi_buf_alloc Integer Overflow Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Fortinet FortiWeb. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-39811.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-265?
ZDI-26-265 is categorized as a denial-of-service vulnerability, with the potential to significantly disrupt Fortinet FortiWeb services.
How do I fix ZDI-26-265?
To mitigate ZDI-26-265, ensure your Fortinet FortiWeb is updated to the latest security patches provided by Fortinet.
Who can exploit ZDI-26-265?
ZDI-26-265 can be exploited by remote attackers, although authentication is required to initiate the attack.
What impact does ZDI-26-265 have on Fortinet FortiWeb?
Exploiting ZDI-26-265 could lead to an integer overflow, resulting in a denial-of-service condition on affected systems.
Is authentication required for ZDI-26-265 exploitation?
Yes, authentication is required to exploit the ZDI-26-265 vulnerability on Fortinet FortiWeb.