FG-IR-26-195: Broken Access Control in Two-Factor-Authentication

Q: Which deployments are exposed to this issue?

The issue applies to FortiOS deployments using Remote RADIUS Type Admin two-factor authentication. Exploitation additionally depends on the RADIUS server returning an additional Access-Challenge response after an invalid TFA token is submitted.

Q: What access does an attacker need before attempting exploitation?

An attacker must be remotely authenticated and have at least read-only permission. They also need a valid username and password; the bypass concerns acceptance of an invalid TFA token under the specified RADIUS response condition.

Published Nov 10, 2026

Updated

An Improper Authentication vulnerability [CWE-287] in the FortiOS Remote Radius Type Admin Two-Factor (TFA) Authentication may allow a remote authenticated attacker with at least read-only permission to log in to the FortiOS GUI with an invalid token after entering a valid username and password, in scenarios where the RADIUS server returns an additional "Access-Challenge" response following an invalid TFA token.

Affected Software

1 affected componentFixes available

Fortinet FortiOS>=7.6.0<=7.6.6

Event History

Nov 10, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue applies to FortiOS deployments using Remote RADIUS Type Admin two-factor authentication. Exploitation additionally depends on the RADIUS server returning an additional Access-Challenge response after an invalid TFA token is submitted.

What access does an attacker need before attempting exploitation?

An attacker must be remotely authenticated and have at least read-only permission. They also need a valid username and password; the bypass concerns acceptance of an invalid TFA token under the specified RADIUS response condition.

FG-IR-26-195: Broken Access Control in Two-Factor-Authentication

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need before attempting exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need before attempting exploitation?