An out‑of‑bounds write flaw exists in Fortinet FortiWeb firmware versions 8.0.0 through 8.0.3, 7.6.0 through 7.6.6, and 7.4.0 through 7.4.11. A privileged attacker can send specially crafted HTTP requests that trigger a memory corruption, allowing remote execution of arbitrary code or system commands. This flaw compromises the confidentiality, integrity and availability of the impacted Web Application Firewall, potentially giving an attacker full control over the appliance.

Fortinet FortiWeb devices running versions 8.0.0 through 8.0.3, 7.6.0 through 7.6.6, and 7.4.0 through 7.4.11 are affected. The product is a web application firewall released by Fortinet.

The CVSS base score is 6.7, indicating a moderate severity. A publicly published EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly specified in the advisory; based on the nature of the flaw, the likely vector comes from requests processed by the FortiWeb appliance, which suggests remote exploitation through network traffic directed at the device.