CVE-2026-126251CVSS 9.1Authorization bypass
A network attacker without credentials can bypass authentication and gain access.
FortiAuthenticator fixes two unauthenticated bypasses and five related vulnerabilities
Fortinet fixed two unauthenticated access bypasses and five other FortiAuthenticator flaws. Versions 8.0.0–8.0.3 and 6.6.0–6.6.10 are affected. The hard-coded password flaw requires conditions outside the attacker’s control.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- CVSS 9.1 × 1
- 7 CVEs tracked here
- Splash zone
- Network-reachable FortiAuthenticator 8.0.0–8.0.3 and 6.6.0–6.6.10. Some flaws additionally require authentication.
- Fortinet · FortiAuthenticator · Authentication bypass
- In the wild
- Unknown
- No in-the-wild exploitation was verified for these seven CVEs.
What happened
FortiAuthenticator is Fortinet’s identity and authentication appliance. The two critical findings both allow unauthorized access from the network without a login according to Fortinet’s CVSS vectors. CVE-2026-126257 depends on circumstances the attacker does not control. The materials do not specify the precise condition, request or endpoint. The LDAP injection is distinct and requires an authenticated attacker and a specific upstream identity-provider configuration or compromise.
Fortinet’s machine-readable advisories show identical affected intervals and upgrade targets for the seven CVEs listed here. The regular PSIRT pages could not be opened during verification. Direct vendor CSAF files in the order of the CVEs above: FG-IR-26-265, FG-IR-26-271, FG-IR-26-255, FG-IR-26-256, FG-IR-26-258, FG-IR-26-263, FG-IR-26-266. This is the FortiAuthenticator batch and does not assess other Fortinet products. The reviewed material does not establish victims, data access or active exploitation.
What’s in the bowl
CVE-2026-126257CVSS 9Hard-coded password
An unauthenticated attacker can bypass credential validation under conditions outside the attacker’s control.
CVE-2026-126240CVSS 8.2LDAP query injection
An authenticated attacker can bypass authentication if the upstream identity provider is malicious or compromised, or lets the user control the NameID or equivalent SAML username attribute.
CVE-2026-126241CVSS 8.8SQL injection
An authenticated attacker can run unauthorized SQL commands on the underlying database.
CVE-2026-126244CVSS 7.5Unthrottled resource allocation
An unauthenticated attacker can exhaust resources and cause a denial of service.
CVE-2026-126249CVSS 7.2Privilege escalation
An authenticated attacker with high privileges can escalate privileges, according to the vendor vector and advisory.
CVE-2026-126252CVSS 8.3Collector Agent SQL injection
An authenticated attacker can execute unauthorized code or commands through SQL injection in the Collector Agent.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| FortiAuthenticator 8.0 | 8.0.4 | |
| FortiAuthenticator 6.6 | 6.6.11 |
Crime-scene timeline
Nov 10, 2026
Fortinet publishes the product advisories
Seven FortiAuthenticator entries specify the same affected ranges and fixed releases.
Nov 11, 2026
Fortinet publishes the two bypass CVE records
The CNA records confirm the fixes and differentiate the authorization and password flaws.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- FortiGuard PSIRT feedPrimaryLists the November 10 advisories and links to Fortinet’s CSAF files.
- Fortinet CNA authorization bypass recordPrimaryRecords the affected branches, scoring and fixed releases.
- Fortinet CNA hard-coded password recordPrimaryDescribes the conditional unauthenticated bypass and same fixes.