CVE-2026-126247: High severity vulnerability
A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.6.11 - Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
Which FortiAuthenticator versions are affected?
Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.
What access does an attacker need to exploit this issue?
An attacker must be authenticated with privileged access. Exploitation is performed through HTTP requests and does not require user interaction.
What could successful exploitation allow?
A successful attacker may execute unauthorized code or commands. The listed impact includes high confidentiality, integrity, and availability impact.