Executive brief
FortiAuthenticator is a centralized identity management appliance used to manage user authentication and digital certificates. A critical security flaw in its API allows an unauthenticated attacker to remotely execute unauthorized commands or code. This could lead to a complete takeover of the authentication system, potentially compromising user credentials and network access controls.
Technical details
An improper access control vulnerability (CWE-284) exists within the API component of Fortinet FortiAuthenticator. The flaw allows a remote, unauthenticated attacker to bypass security restrictions by sending specially crafted network requests to affected API endpoints. Successful exploitation enables the execution of unauthorized code or system commands with the privileges of the application. The vulnerability affects versions 8.0.0, 8.0.2, 6.6.x (up to 6.6.8), and 6.5.x (up to 6.5.6). Users are advised to upgrade to versions 8.0.3, 6.6.9, or 6.5.7 respectively, or disable API access on exposed interfaces as a workaround.
Affected products
- Fortinet FortiAuthenticator 8.0.0, 8.0.2, 6.6.0 through 6.6.8, 6.5.0 through 6.5.6
Timeline
- 2026-05-12: disclosed: Initial publication of the advisory by Fortinet
- 2026-05-12: advisory: NVD published the CVE record