CVE-2026-126237: High severity vulnerability
A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to cause a denial of service via crafted TCP requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.6.11 - Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
Which FortiAuthenticator versions are affected?
Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attack access with low complexity, no privileges required, and no user interaction.
What is the expected impact of a successful attack?
A remote attacker can cause a denial of service by sending crafted TCP requests. The provided vector indicates availability impact only, with no stated confidentiality or integrity impact.