CVE-2026-126249: High severity vulnerability
Published Nov 11, 2026
·Updated
A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.6.11 - Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Nov 11, 2026
CVE Published
via MITRE·09:31 PM
Data Sourced
via MITRE·09:31 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must already be authenticated to FortiAuthenticator and have the ability to interact with an affected instance. The issue may allow that authenticated attacker to escalate privileges.
2
Which FortiAuthenticator versions are affected?
Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and FortiAuthenticator 6.6.0 through 6.6.10.