Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
2963 articles · 110875 vulns · 36/41 feeds (7d)
← Back to list
6.7
CVE-2026-40688EXPLOITEDPATCHED
Fortinet · FortiWeb

CVE-2026-40688: A out-of-bounds write vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4

Description

A out-of-bounds write vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Affected Products

VendorProductVersions
FortinetFortiWeb8.0.0, 7.6.0, 7.4.0

References

  • https://fortiguard.fortinet.com/psirt/FG-IR-26-127

Related News (1 articles)

Tier A
Fortinet PSIRT-21141s ago
Out-Of-Bounds Write in administrative interface
→ No new info (linked only)
CVSS 3.16.7 MEDIUM
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
8.0.4
CWECWE-787
PublishedApr 14, 2026
Last enriched2h agov2
Trending Score58
Source articles3
Independent2
Info Completeness10/14
Missing: epss, kev, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-21643EXPKEV
CVE-2026-21643: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiC
Trending: 151
CRITICALCVE-2026-35616EXPKEV
CVE-2026-35616: A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
Trending: 127
CRITICALCVE-2026-39808EXP
CVE-2026-39808: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
Trending: 73
CRITICALCVE-2026-39813EXP
CVE-2026-39813: A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.
Trending: 73
HIGHCVE-2026-22828EXP
CVE-2026-22828: A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2
Trending: 61

Pin to Dashboard

Verification

State: verified
Confidence: 0%

Vulnerability Timeline

CVE Published
Apr 14, 2026
Discovered by ZDM
Apr 14, 2026
Updated: description, affectedVersions, severity, exploitAvailable, activelyExploited, patchAvailable
Apr 14, 2026
Actively Exploited
Apr 14, 2026
Exploit Available
Apr 14, 2026
Patch Available
Apr 14, 2026

Version History

v2
Last enriched 2h ago
v2Tier A2h ago

Updated description with technical details, changed severity to HIGH, and provided new patch versions 8.0.4, 7.6.7, and 7.4.12.

descriptionaffectedVersionsseverityexploitAvailableactivelyExploitedpatchAvailable
via Fortinet PSIRT
v12h ago

Initial creation