CVE-2026-126252: SQL Injection

Published Nov 11, 2026

Updated

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must already be authenticated to FortiAuthenticator. Exploitation is performed through HTTP requests and does not require user interaction.

Which FortiAuthenticator versions are affected?

Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and FortiAuthenticator 6.6.0 through 6.6.10.

What could a successful attacker do?

A successful exploit may allow the authenticated attacker to execute unauthorized code or commands. The reported impact includes high confidentiality and integrity impact, with low availability impact.

CVE-2026-126252: SQL Injection

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which FortiAuthenticator versions are affected?

What could a successful attacker do?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which FortiAuthenticator versions are affected?

What could a successful attacker do?