CVE-2026-24641

MediumCVSS 6.5/10Last modified Nov 6, 2026

Description

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP requests.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 8.0.0, <= 8.0.2; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.13; >= 7.2.0, <= 7.2.13; >= 7.0.0, <= 7.0.12

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-089Vendor Advisory

Timeline

Published: Mar 10, 2026
Last modified: Nov 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-24658.8Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Tur CVE-2026-246563.7Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without CVE-2026-24667.1The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re CVE-2026-246608.1A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malici CVE-2026-246616.5Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated CVE-2026-246624.8Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a file cont CVE-2026-246639.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote c CVE-2026-246645.3The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumerati CVE-2026-246655.4The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site CVE-2026-246666.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request CVE-2026-246675.0The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidat CVE-2026-246686.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access cont