Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126251 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiAuthenticator |
| Vulnerability Type | incorrect authorization (CWE-863) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.
The CVSS vector indicates a network attack without authentication or user interaction (AV:N/PR:N/UI:N) with high impact on integrity and availability. FortiAuthenticator is an authentication server (RADIUS/LDAP, MFA, SSO) used, among others, for FortiGate VPN logins — its compromise opens the way to accounts and remote access.
Required Actions
- Update FortiAuthenticator to the version listed in Fortinet advisory FG-IR-26-265.
- Restrict access to the FortiAuthenticator administrative interface to the management network.
- Review authentication logs and administrator accounts for unusual logins and new accounts.
Who Is Affected?
The vulnerability affects Fortinet FortiAuthenticator 8.0.0–8.0.3 and 6.6.0–6.6.10. FortiAuthenticator is an authentication server (RADIUS/LDAP, MFA, SSO) used, among others, for FortiGate VPN logins — its compromise opens the way to accounts and remote access.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126251 vulnerability?
CVE-2026-126251 is an incorrect authorization flaw (CWE-863) in Fortinet FortiAuthenticator that allows authentication bypass and unauthorized access. CVSS score: 9.1.
Does exploiting CVE-2026-126251 require authentication?
No. According to the CVSS vector, the attack is network-based and requires no authentication or user interaction.
How to protect against CVE-2026-126251?
Update FortiAuthenticator as per advisory FG-IR-26-265 and restrict access to its administrative interface.
Who is affected by CVE-2026-126251?
Organizations running FortiAuthenticator 6.6.0–6.6.10 or 8.0.0–8.0.3.
