CVE-2026-126251: Critical severity vulnerability
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.6.11 - Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and FortiAuthenticator 6.6.0 through 6.6.10.
Does exploitation require credentials or user interaction?
No. The vulnerability is rated with no privileges required and no user interaction required, and it may allow authentication to be bypassed.
What access could an attacker obtain?
An attacker may gain unauthorized access by bypassing authentication. The vulnerability is rated as having high integrity and availability impact, with no confidentiality impact.