---
id: CVE-2026-24641
title: >-
  A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet
  FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all
  versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an
  authent…
summary: >-
  A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet
  FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all
  versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an
  authent…
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-476
vendor: Fortinet
product: FortiWeb
affected:
  - FortiWeb >= 8.0.0 <= 8.0.2
  - FortiWeb >= 7.6.0 <= 7.6.6
  - FortiWeb >= 7.4.0 <= 7.4.13
  - FortiWeb >= 7.2.0 <= 7.2.13
  - FortiWeb >= 7.0.0 <= 7.0.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-12T14:27:30.386135Z'
published: '2026-03-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:11.282Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-24641'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-089'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-089'
tags:
  - cve.org
epss: 0.00448
epssPercentile: 0.39141
ingestedAt: '2026-11-06T15:54:03.977Z'
---

## Overview

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP requests.

## Affected

- `FortiWeb >= 8.0.0 <= 8.0.2`
- `FortiWeb >= 7.6.0 <= 7.6.6`
- `FortiWeb >= 7.4.0 <= 7.4.13`
- `FortiWeb >= 7.2.0 <= 7.2.13`
- `FortiWeb >= 7.0.0 <= 7.0.12`

## Remediation

Upgrade to FortiWeb version 8.0.3 or above
Upgrade to FortiWeb version 7.6.7 or above