ZDI-CAN-28661: ZDI-26-266: Fortinet FortiWeb cat_cgi_paths Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Apr 15, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiWeb. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-40688.

Affected Software

1 affected component

Fortinet FortiWeb

Event History

Apr 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28661?

ZDI-CAN-28661 has a critical severity rating due to its potential for remote code execution.

How do I fix ZDI-CAN-28661?

To fix ZDI-CAN-28661, update your Fortinet FortiWeb installation to the latest patched version provided by Fortinet.

Who is affected by ZDI-CAN-28661?

ZDI-CAN-28661 affects installations of Fortinet FortiWeb that are not patched against this vulnerability.

What type of vulnerability is ZDI-CAN-28661?

ZDI-CAN-28661 is categorized as an Out-Of-Bounds Write vulnerability, allowing for remote code execution.

What conditions are required to exploit ZDI-CAN-28661?

Exploitation of ZDI-CAN-28661 requires authentication to the Fortinet FortiWeb system.