CVE-2026-126246: Null Pointer Dereference

Published Nov 11, 2026

Updated

A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform a denial of service attack via http requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 are affected.

Does exploitation require credentials or user interaction?

No. An unauthenticated attacker can exploit the issue through HTTP requests, and no user interaction is required.

What is the expected impact of a successful attack?

Successful exploitation may cause a denial of service. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.

CVE-2026-126246: Null Pointer Dereference

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require credentials or user interaction?

What is the expected impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require credentials or user interaction?

What is the expected impact of a successful attack?