Cyber Resilience

CVE-2026-24641

Low

Published: 10 March 2026

Published
10 March 2026
Modified
12 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0014 33.3th percentile
Risk Priority 5 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24641 is a low-severity NULL Pointer Dereference (CWE-476) vulnerability in Fortinet Fortiweb. Its CVSS base score is 2.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 33.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via…

more

crafted HTTP requests.

CWE(s)
CWE-476

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

NULL pointer dereference enables authenticated attacker to crash HTTP daemon via crafted requests, directly matching application exploitation for DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

fortinet
fortiweb
7.0.0 — 7.6.7 · 8.0.0 — 8.0.3

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References