CVE-2026-126241: SQL Injection

Published Nov 11, 2026

Updated

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to FortiAuthenticator. The vulnerability can be exploited remotely with low attack complexity and does not require user interaction.

Which deployments are affected?

Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. The provided information does not identify any configuration prerequisite or workaround.

What could a successful attacker do?

A successful authenticated attacker may execute unauthorized SQL commands against the underlying database. The listed impact includes high confidentiality, integrity, and availability impact.

CVE-2026-126241: SQL Injection

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What could a successful attacker do?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What could a successful attacker do?