CVE-2026-126238: High severity vulnerability

Published Nov 11, 2026

Updated

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.

Does exploitation require an authenticated account or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker, and the provided vector indicates no user interaction is required.

What level of access could an attacker obtain?

An attacker may bypass authorization checks and gain unauthorized access to restricted functionality.

CVE-2026-126238: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated account or user interaction?

What level of access could an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated account or user interaction?

What level of access could an attacker obtain?