Paper/Archive/CVE-2026-44277

CVE-2026-44277

Fortinet FortiAuthenticator — A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through…

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 46.1.461 × 209.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.

Affected

ProductAffectedFixed inSource

FortiAuthenticator8.0.2–CNA

FortiAuthenticator8.0.0–CNA

FortiAuthenticator6.6.0 – 6.6.8–CNA

FortiAuthenticator6.5.0 – 6.5.6–CNA

FortiAuthenticator6.4.0 – 6.4.10–CNA

Scores by source

fortinet (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-26-128