# CVE-2026-126246: Fortinet FortiAuthenticator null pointer dereference

Source: https://junglewise.ai/threats/cve-2026-126246-a-null-pointer-dereference-vulnerability-in-fortinet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126246 · Severity: high · CVSS 7.5 · Published 2026-11-11

FortiAuthenticator is an authentication and user management solution used by organizations to control access to corporate resources. A null pointer dereference vulnerability in the web interface allows unauthenticated attackers to crash the service, causing a denial of service that blocks legitimate users from authenticating and accessing systems.

Technologies: [Fortinet FortiAuthenticator](https://junglewise.ai/threats/technologies/fortiauthenticator). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2026-126246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126246 being exploited in the wild.

**How severe is CVE-2026-126246?** High severity, with a CVSS score of 7.5, published 11 November 2026.

**Which products and versions are affected?** Fortinet FortiAuthenticator 8.0.0 through 8.0.3, 6.6.0 through 6.6.10.

**Is there a fix for CVE-2026-126246?** Yes: fixed in FortiAuthenticator 8.0.4 or above, 6.6.11 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126246 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126246?** Check whether you run Fortinet FortiAuthenticator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FortiAuthenticator 8.0.4 or above, 6.6.11 or above

## Technical details

A null pointer dereference (CWE-476) in the FortiAuthenticator GUI allows an unauthenticated attacker to trigger a crash via HTTP requests. The vulnerability affects versions 8.0.0–8.0.3 and 6.6.0–6.6.10, requiring only network access and no authentication. Exploitation results in denial of service; patches are available in FortiAuthenticator 8.0.4+ and 6.6.11+.

## Affected products

- Fortinet FortiAuthenticator 8.0.0 through 8.0.3, 6.6.0 through 6.6.10

## Timeline

- 2026-11-10: disclosed

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-260](https://fortiguard.fortinet.com/psirt/FG-IR-26-260)

## Related threats

- [Fortinet FortiAuthenticator hard-coded password authentication bypass](https://junglewise.ai/threats/cve-2026-126257-a-use-of-hard-coded-password-vulnerability-in-fortinet)
- [Fortinet FortiAuthenticator SQL injection](https://junglewise.ai/threats/cve-2026-126252-a-improper-neutralization-of-special-elements-used-in-an-sql)
- [Fortinet FortiAuthenticator incorrect authorization](https://junglewise.ai/threats/cve-2026-126251-a-incorrect-authorization-vulnerability-in-fortinet)
- [Fortinet FortiAuthenticator authorization bypass DoS](https://junglewise.ai/threats/cve-2026-126250-a-incorrect-authorization-vulnerability-in-fortinet)
- [Fortinet FortiAuthenticator privilege escalation in GUI](https://junglewise.ai/threats/cve-2026-126249-a-improper-privilege-management-vulnerability-in-fortinet)