{"id":"CVE-2026-40688","aliases":["EUVD-2026-22808","GHSA-m3qh-6w2c-jgrx"],"status":"published","title":"A out-of-bounds write vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0...","description":"An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.06438,"percentile":0.93767,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-04-14T22:35:15Z","modified":"2026-07-24T21:10:00Z","products":[{"vendor":"fortinet","product":"fortiweb"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-127","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40688"},{"url":"https://github.com/advisories/GHSA-m3qh-6w2c-jgrx"}],"sources":{"cve":[{"id":"CVE-2026-40688","description":"An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests.","status":"published","published":"2026-04-14T22:35:15.438Z","modified":"2026-04-16T03:55:18.342Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-22808","description":"An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests.","status":"published","published":"2026-04-14T22:35:15Z","modified":"2026-04-16T03:55:18Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-02T19:24:24.796113Z"}],"ghsa":[{"id":"GHSA-m3qh-6w2c-jgrx","title":"A out-of-bounds write vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0...","description":"A out-of-bounds write vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow attacker to execute unauthorized code or commands via \u003cinsert attack vector here\u003e","status":"published","published":"2026-04-15T00:31:36Z","modified":"2026-04-15T00:31:47Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:07:30.592661Z"}],"nvd":[{"id":"CVE-2026-40688","description":"An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests.","status":"published","published":"2026-04-14T23:16:29.633Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:14.748836Z"}]}}