Use of Hard-Coded Password Vulnerability in Fortinet FortiAuthenticator
CVE-2026-126257

9CRITICAL

Key Information:

Vendor

Fortinet
Status
Fortiauthenticator
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126257?

A vulnerability in Fortinet's FortiAuthenticator allows attackers to exploit hard-coded passwords, enabling unauthorized access without proper authentication. This affects FortiAuthenticator versions 8.0.0 to 8.0.3 and 6.6.0 to 6.6.10, allowing potential attackers to bypass credential validation in specific circumstances, putting sensitive data at risk.

Affected Version(s)

FortiAuthenticator 8.0.0 <= 8.0.3

FortiAuthenticator 6.6.0 <= 6.6.10

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-271

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.