CVE-2026-126239: Buffer Overflow

Published Nov 11, 2026

Updated

A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiAuthenticator versions are affected?

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 are affected.

Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can trigger the issue remotely using crafted HTTP requests, and no user interaction is required.

What is the practical impact of exploitation?

Successful exploitation may crash the FSSO subsystem, resulting in an availability impact. The provided information does not indicate confidentiality or integrity impact.