CVE-2025-48840: Fortinet FortiWeb

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote unauthenticated attacker to bypass hostname restrictions via a specially crafted request.

Affected products

• Fortinet FortiWeb: from 7.0.0, before 7.4.9 (fixed in 7.4.9); from 7.6.0, before 7.6.4 (fixed in 7.6.4)

Published 2026-03-10. Last modified 2026-06-17.