CVE-2026-126243: High severity vulnerability
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.6.11 - Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.5.8
Event History
Frequently Asked Questions
What access does an attacker need before exploiting this issue?
The vulnerability has a high privileges required rating (PR:H), so the attacker needs high-level privileges before exploitation. Full impersonation also requires obtaining pre-required ID and data through other means.
Which FortiAuthenticator releases are affected?
Affected releases are FortiAuthenticator 8.0.0 through 8.0.3 and FortiAuthenticator 6.6.0 through 6.6.10.
What is the potential impact if exploitation succeeds?
An attacker may bypass authentication and gain unauthorized access. The stated impact includes high confidentiality, integrity, and availability effects.