Topic starter
18/08/2026 2:10 pm
TL;DR: CVE-2026-26035 in Fortinet FortiWeb is a pre-authentication improper authentication flaw that can let a remote attacker reach administrative access through the GUI or CLI, according to CYCOGNITO’s analysis of the advisory and exposure patterns. The issue shows how management-plane identity controls become the attack surface when appliance administration depends on remote authentication.
Editorial analysis by NHI Mgmt Group, based on content published by CYCOGNITO: “Emerging Threat: (CVE-2026-26035) FortiWeb Admin Authentication Bypass via RADIUS Admin Groups”.
Key questions
Q: What breaks when a WAF’s RADIUS admin path fails authentication?
A: The management plane breaks first.
Q: Why do remote administrator authentication flows create high risk in appliance environments?
A: Because they concentrate control over the device that enforces policy for many downstream systems.
Q: What do security teams get wrong about appliance admin bypass risk?
A: They often focus on the firmware version and ignore the authentication configuration.
Practitioner guidance
- Inventory appliance admin paths Identify every FortiWeb instance and record whether administrator access uses a remote RADIUS admin group or only local accounts.
- Restrict management-plane reachability Place the FortiWeb management interface behind a dedicated administration network and remove broad user-network reachability.
- Disable unnecessary remote admin groups If local administrator accounts are sufficient for the operating model, remove RADIUS-based administrator groups to eliminate the vulnerable trust path.
Bottom line: The core issue is an improper authentication failure in the FortiWeb RADIUS admin path, which can let an unauthenticated attacker reach privileged management functions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:02 pm
Management-plane identity is a high-value attack surface: When appliance administration relies on remote authentication, the identity path is no longer a simple access layer, it becomes part of the control plane itself. A flaw in that path can convert a security device into an administrative foothold. For practitioners, that means admin authentication design deserves the same scrutiny as the firewall policy it protects.
A question worth separating out:
Q: Should organisations keep RADIUS-backed appliance administration or move to local accounts?
A: That choice depends on operational need, but the key is to remove unnecessary trust paths. If centralised admin authentication is required, it must be tightly scoped and monitored. If it is not required, local accounts reduce one exposed dependency and simplify the attack surface on the management plane.
👉 Read our full editorial: FortiWeb authentication bypass exposes the risk in RADIUS admin flows