by Kastro
Paper/Archive/CVE-2026-126257

CVE-2026-126257

Fortinet FortiAuthenticator — A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 ma…

CVSS 9.0
critical.is priorityof 100
27
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.

Affected

ProductAffectedFixed inSource
FortiAuthenticator8.0.0 – 8.0.3–CNA
FortiAuthenticator6.6.0 – 6.6.10–CNA

Scores by source

fortinet (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-271