Is CVE-2026-126242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126242 being exploited in the wild.

How severe is CVE-2026-126242?

High severity, with a CVSS score of 7.4, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiAuthenticator 8.0.0 through 8.0.3, 6.6.0 through 6.6.10.

Is there a fix for CVE-2026-126242?

Yes: fixed in FortiAuthenticator 8.0.4 or above, 6.6.11 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126242 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-126242?

Check whether you run Fortinet FortiAuthenticator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126242: Fortinet FortiAuthenticator incorrect authorization in API

CVE-2026-126242 · Severity: high · CVSS 7.4 · Published 2026-11-11

FortiAuthenticator is a centralized authentication service used to manage user access across Fortinet security products. An authorization flaw in the API allows attackers to bypass authentication checks and gain unauthorized access to the system. While the vulnerability alone enables authentication bypass, full account impersonation requires the attacker to separately obtain additional user identifiers and data.

Technologies: Fortinet FortiAuthenticator. Vendors: Fortinet.

Quick answers

Is CVE-2026-126242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126242 being exploited in the wild.
How severe is CVE-2026-126242?: High severity, with a CVSS score of 7.4, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiAuthenticator 8.0.0 through 8.0.3, 6.6.0 through 6.6.10.
Is there a fix for CVE-2026-126242?: Yes: fixed in FortiAuthenticator 8.0.4 or above, 6.6.11 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126242 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-126242?: Check whether you run Fortinet FortiAuthenticator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiAuthenticator 8.0.4 or above, 6.6.11 or above

Technical details

The FortiAuthenticator API implements incorrect authorization logic (CWE-863) that permits attackers to bypass authentication controls without valid credentials. The vulnerability is unauthenticated and remotely exploitable via the network. Successful exploitation grants unauthorized access to the system; however, escalation to full user impersonation requires pre-obtained user identifiers and supplementary data obtained through separate means.

Affected products

Fortinet FortiAuthenticator 8.0.0 through 8.0.3, 6.6.0 through 6.6.10

Timeline

2026-11-10: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-257

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.