CVE-2026-126248: High severity vulnerability

Published Nov 11, 2026

Updated

A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 are affected.

Does exploitation require an account or user interaction?

No. The vulnerability may be exploited by an unauthenticated attacker through HTTPS requests, with no user interaction indicated.

What is the likely impact of successful exploitation?

An attacker may obtain sensitive information. The provided severity vector indicates high confidentiality impact, with no integrity or availability impact listed.