9.3
Critical
CVE-2021-42756 Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7…
Description
Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiWeb 6.4 | 6.4.0 → 6.4.1 | No fix stated |
| FortiWeb 6.3 | 6.3.0 → 6.3.16 | No fix stated |
| FortiWeb 6.2 | 6.2.0 → 6.2.6 | No fix stated |
| FortiWeb 6.1 | 6.1.0 → 6.1.2 | No fix stated |
| FortiWeb 6.0 | 6.0.0 → 6.0.7 | No fix stated |
| FortiWeb 5.9 | 5.9.0 → 5.9.1 | No fix stated |
| FortiWeb 5.8 | 5.8.0 → latest | No fix stated |
| FortiWeb 5.7 | 5.7.0 → latest | No fix stated |
| FortiWeb 5.6 | 5.6.0 → latest | No fix stated |
Other CVEs of FortiWeb
The 74 CVEs of FortiWeb →
CVE-2026-26035
An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb…
8.8
High
CVE-2026-70466
A incomplete list of disallowed inputs vulnerability [CWE-184] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2,…
4.8
Medium
CVE-2026-40688
An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0…
6.7
Medium
CVE-2026-39811
A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6,…
4.4
Medium