CVE-2026-126240: High severity vulnerability

Published Nov 11, 2026

Updated

A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed to exploitation?

Affected deployments are FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 that use an upstream IdP. Exploitation depends on the IdP being malicious or compromised, or on its configuration allowing users to control the NameID or SAML attribute used as the username.

What level of access does an attacker need?

The attacker must be authenticated. They also need influence over the upstream identity assertions, either through a malicious or compromised IdP or through user control of the username-related SAML value.

What is the security impact if exploitation succeeds?

Successful exploitation may allow the authenticated attacker to bypass authentication. The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.

CVE-2026-126240: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to exploitation?

What level of access does an attacker need?

What is the security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to exploitation?

What level of access does an attacker need?

What is the security impact if exploitation succeeds?