Authorization Bypass in Fortinet FortiAuthenticator
CVE-2026-126238

8.6HIGH

Key Information:

Vendor

Fortinet
Status
Fortiauthenticator
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126238?

Fortinet's FortiAuthenticator is exposed to an authorization bypass vulnerability that affects versions 8.0.0 through 8.0.3 as well as 6.6.0 through 6.6.10. This flaw allows unauthenticated attackers to circumvent authorization mechanisms, potentially granting them access to restricted functionalities that should only be available to authenticated users. Organizations using impacted versions are urged to apply necessary patches and implement additional security measures.

Affected Version(s)

FortiAuthenticator 8.0.0 <= 8.0.3

FortiAuthenticator 6.6.0 <= 6.6.10

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-253

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.