CVE-2026-126245: High severity vulnerability

Published Nov 11, 2026

Updated

A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiAuthenticator releases are affected?

Affected releases are FortiAuthenticator 8.0.0 through 8.0.3 and FortiAuthenticator 6.6.0 through 6.6.10.

Does exploitation require an authenticated account or user interaction?

No. The issue may be exploited by an unauthenticated attacker through HTTP requests, and no user interaction is indicated.

What additional condition does an attacker need to meet?

The attacker must be able to defeat ASLR protections. The stated potential outcome is unauthorized code or command execution.

CVE-2026-126245: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which FortiAuthenticator releases are affected?

Does exploitation require an authenticated account or user interaction?

What additional condition does an attacker need to meet?

Company

Resources

Contact

Frequently Asked Questions

Which FortiAuthenticator releases are affected?

Does exploitation require an authenticated account or user interaction?

What additional condition does an attacker need to meet?