Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126257 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiAuthenticator |
| Vulnerability Type | use of hard-coded password (CWE-259) |
| CVSS Score | 9.0 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker’s control and gain unauthorized access.
Exploitation depends on conditions outside the attacker’s control (high attack complexity, AC:H), hence a score of 9.0. The impact, however, extends beyond the device itself (S:C). FortiAuthenticator is an authentication server (RADIUS/LDAP, MFA, SSO) used, among others, for FortiGate VPN logins — its compromise opens the way to accounts and remote access.
Required Actions
- Update FortiAuthenticator to the version listed in Fortinet advisory FG-IR-26-271.
- Restrict network access to FortiAuthenticator to the systems that use it (FortiGate, application servers) and the management network.
- Review authentication logs for successful logins that cannot be tied to users.
Who Is Affected?
The vulnerability affects Fortinet FortiAuthenticator 8.0.0–8.0.3 and 6.6.0–6.6.10. FortiAuthenticator is an authentication server (RADIUS/LDAP, MFA, SSO) used, among others, for FortiGate VPN logins — its compromise opens the way to accounts and remote access.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126257 vulnerability?
CVE-2026-126257 is a use of hard-coded password flaw (CWE-259) in Fortinet FortiAuthenticator that, in certain circumstances, allows bypassing credential validation. CVSS score: 9.0.
Does exploiting CVE-2026-126257 require authentication?
No. The attack requires no authentication, but success depends on circumstances outside the attacker's control (AC:H).
How to protect against CVE-2026-126257?
Update FortiAuthenticator as per advisory FG-IR-26-271 and restrict network access to the device.
Who is affected by CVE-2026-126257?
Organizations running FortiAuthenticator 6.6.0–6.6.10 or 8.0.0–8.0.3.
