{"id":"CVE-2026-24641","title":"A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authent…","summary":"A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authent…","severity":"low","cvss":2.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-476"],"vendor":"Fortinet","product":"FortiWeb","affected":["FortiWeb >= 8.0.0 <= 8.0.2","FortiWeb >= 7.6.0 <= 7.6.6","FortiWeb >= 7.4.0 <= 7.4.13","FortiWeb >= 7.2.0 <= 7.2.13","FortiWeb >= 7.0.0 <= 7.0.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-03-12T14:27:30.386135Z"},"published":"2026-03-10","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:11.282Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-24641","references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-089","label":"https://fortiguard.fortinet.com/psirt/FG-IR-26-089"}],"tags":["cve.org"],"epss":0.00448,"epssPercentile":0.39141,"ingestedAt":"2026-11-06T15:54:03.977Z","slug":"CVE-2026-24641","body":"## Overview\n\nA NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP requests.\n\n## Affected\n\n- `FortiWeb >= 8.0.0 <= 8.0.2`\n- `FortiWeb >= 7.6.0 <= 7.6.6`\n- `FortiWeb >= 7.4.0 <= 7.4.13`\n- `FortiWeb >= 7.2.0 <= 7.2.13`\n- `FortiWeb >= 7.0.0 <= 7.0.12`\n\n## Remediation\n\nUpgrade to FortiWeb version 8.0.3 or above\nUpgrade to FortiWeb version 7.6.7 or above","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}