An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through…
Fortinet · FortiWeb
The flaw is an improper verification of cryptographic signatures in Fortinet FortiWeb (versions 8.0.0, 7.6.0 through 7.6.4, and 7.4.0 through 7.4.9), affecting the FortiCloud SSO login authentication path. An unauthenticated attacker over the network, with no user interaction and no special configuration beyond the FortiCloud SSO login being in use, could bypass that authentication by sending a crafted SAML response message.
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 6 days after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+6 days
- EU database marks exploited+49 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 27 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- PEERSTITCH, a Stealthy FortiGate Implant16 Oct 2026
- PEERSTITCH, a Stealthy FortiGate Implant14 Oct 2026
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant14 Oct 2026
- Actief misbruik kwetsbaarheden Fortinet producten [Nationaal Cyber Security Centrum - Nieuwsberichten]31 Jul 2026
- Operation Storming Tide: A massive multi-stage intrusion campaign29 Mar 2026
- EbeeMar2026 Pt419 Mar 2026
- 21 more on OTX