CVE-2021-41017: Fortinet FortiWeb

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.

Affected products

• Fortinet FortiWeb: from 6.3.0, up to and including 6.3.15; version 6.4.0 only; version 6.4.1 only

Published 2021-12-08. Last modified 2026-06-17.