Improper Access Control Vulnerability in Fortinet FortiAuthenticator Products
CVE-2026-44277

9.1CRITICAL

Key Information:

Vendor

Fortinet
Status
Fortiauthenticator
Vendor
CVE Published:
12 May 2026

What is CVE-2026-44277?

An improper access control issue has been identified in Fortinet FortiAuthenticator, allowing unauthorized users to execute commands or code. This flaw exists in various versions of FortiAuthenticator, including 8.0.2, 8.0.0, and all versions from 6.5.0 to 6.6.8, potentially leading to unauthorized access and control over the system. Users are advised to implement patches provided by Fortinet to mitigate this vulnerability. For further details, please refer to the official guidance from Fortinet.

Affected Version(s)

FortiAuthenticator 8.0.2

FortiAuthenticator 8.0.0

FortiAuthenticator 6.6.0 <= 6.6.8

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-128

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.