CVE-2026-126257: Critical severity vulnerability
A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.6.11 - Upgrade
Upgrade
Fortinet FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
Which FortiAuthenticator versions are affected?
FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 are affected.
Does exploitation require an authenticated account or user interaction?
No. The vulnerability may be exploited by an unauthenticated attacker and does not require user interaction.
Is exploitation guaranteed against every affected deployment?
No. The bypass is possible only in certain circumstances that are outside of the attacker's control, and the provided information does not identify those circumstances.