Fortinet FortiWeb up to 8.0.2 improper control of interaction frequency

Summaryinfo

A vulnerability, which was classified as critical, was found in Fortinet FortiWeb up to 7.0.11/7.2.11/7.4.10/7.6.5/8.0.2. This vulnerability affects unknown code. The manipulation results in improper control of interaction frequency. This vulnerability is known as CVE-2026-24017. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Fortinet FortiWeb up to 7.0.11/7.2.11/7.4.10/7.6.5/8.0.2. Affected is some unknown functionality. The manipulation with an unknown input leads to a improper control of interaction frequency vulnerability. CWE is classifying the issue as CWE-799. The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password target complexity.

The advisory is shared for download at fortiguard.fortinet.com. This vulnerability is traded as CVE-2026-24017 since 01/20/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Fortinet

Name

• FortiWeb

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.2.10
• 7.2.11
• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3
• 7.4.4
• 7.4.5
• 7.4.6
• 7.4.7
• 7.4.8
• 7.4.9
• 7.4.10
• 7.6.0
• 7.6.1
• 7.6.2
• 7.6.3
• 7.6.4
• 7.6.5
• 8.0.0
• 8.0.1
• 8.0.2

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion