The vulnerability is an improper control of interaction frequency (CWE‑799) that allows a remote unauthenticated attacker to bypass FortiWeb’s authentication rate‑limit by sending crafted requests. Based on the description, it is inferred that the attacker could use this to perform credential guessing or brute‑force attacks, as the rate‑limit enforcement is weakened. This could lead to unauthorized access if the correct credentials are discovered.

The issue affects Fortinet FortiWeb appliances running any of the following software versions: 8.0.0 through 8.0.2, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11.

The CVSS score is 7.3, indicating a high severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is remote and unauthenticated, with the only requirement being the ability to send crafted requests to the authentication endpoints; no privileged access or additional credentials are needed. Based on the description, it is inferred that the success of the attack depends on the attacker’s resources and the password target complexity. The vulnerability does not appear in the CISA KEV catalog.