CVE-2026-126250: High severity vulnerability

Published Nov 11, 2026

Updated

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to cause a denial of service via HTTP requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.

Does exploitation require credentials or user interaction?

No. An unauthenticated attacker can trigger the denial of service through HTTP requests, with no user interaction indicated.

What impact can an attacker achieve?

The reported impact is denial of service. The provided information does not indicate confidentiality impact, while integrity impact is rated low and availability impact high.

CVE-2026-126250: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require credentials or user interaction?

What impact can an attacker achieve?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require credentials or user interaction?

What impact can an attacker achieve?