{"schema_version":1,"title":"Fortinet FortiAuthenticator vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 22 vulnerabilities in Fortinet FortiAuthenticator: 18 in the last 7 days and 18 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126257, was published on 11 November 2026. Nothing was published in the last eight weeks.","url":"https://junglewise.ai/threats/technologies/fortiauthenticator","json_url":"https://junglewise.ai/threats/technologies/fortiauthenticator.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/fortiauthenticator","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":16,"all_time":22,"critical":3,"exploited":0,"last_7_days":18,"last_30_days":18,"last_90_days":18,"last_365_days":22},"latest":[{"cve":"CVE-2026-126257","cvss":9,"slug":"cve-2026-126257-a-use-of-hard-coded-password-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator hard-coded password authentication bypass","severity":"critical","exploited":false,"published_at":"2026-11-11T22:17:25.93+00:00","url":"https://junglewise.ai/threats/cve-2026-126257-a-use-of-hard-coded-password-vulnerability-in-fortinet"},{"cve":"CVE-2026-126252","cvss":8.3,"slug":"cve-2026-126252-a-improper-neutralization-of-special-elements-used-in-an-sql","title":"Fortinet FortiAuthenticator SQL injection","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:25.22+00:00","url":"https://junglewise.ai/threats/cve-2026-126252-a-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-126251","cvss":9.1,"slug":"cve-2026-126251-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator incorrect authorization","severity":"critical","exploited":false,"published_at":"2026-11-11T22:17:25.087+00:00","url":"https://junglewise.ai/threats/cve-2026-126251-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126250","cvss":8.2,"slug":"cve-2026-126250-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator authorization bypass DoS","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.96+00:00","url":"https://junglewise.ai/threats/cve-2026-126250-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126249","cvss":7.2,"slug":"cve-2026-126249-a-improper-privilege-management-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator privilege escalation in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.823+00:00","url":"https://junglewise.ai/threats/cve-2026-126249-a-improper-privilege-management-vulnerability-in-fortinet"},{"cve":"CVE-2026-126248","cvss":7.5,"slug":"cve-2026-126248-a-insufficiently-protected-credentials-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator insufficiently protected credentials","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.693+00:00","url":"https://junglewise.ai/threats/cve-2026-126248-a-insufficiently-protected-credentials-vulnerability-in-fortinet"},{"cve":"CVE-2026-126247","cvss":7.2,"slug":"cve-2026-126247-a-use-of-externally-controlled-format-string-vulnerability-in","title":"Fortinet FortiAuthenticator format string code execution","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.56+00:00","url":"https://junglewise.ai/threats/cve-2026-126247-a-use-of-externally-controlled-format-string-vulnerability-in"},{"cve":"CVE-2026-126246","cvss":7.5,"slug":"cve-2026-126246-a-null-pointer-dereference-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator null pointer dereference","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.423+00:00","url":"https://junglewise.ai/threats/cve-2026-126246-a-null-pointer-dereference-vulnerability-in-fortinet"},{"cve":"CVE-2026-126245","cvss":8.1,"slug":"cve-2026-126245-a-out-of-bounds-write-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator out-of-bounds write in API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.28+00:00","url":"https://junglewise.ai/threats/cve-2026-126245-a-out-of-bounds-write-vulnerability-in-fortinet"},{"cve":"CVE-2026-126244","cvss":7.5,"slug":"cve-2026-126244-a-allocation-of-resources-without-limits-or-throttling","title":"Fortinet FortiAuthenticator resource exhaustion denial of service","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.147+00:00","url":"https://junglewise.ai/threats/cve-2026-126244-a-allocation-of-resources-without-limits-or-throttling"},{"cve":"CVE-2026-126243","cvss":7.2,"slug":"cve-2026-126243-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator incorrect authorization","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.02+00:00","url":"https://junglewise.ai/threats/cve-2026-126243-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126242","cvss":7.4,"slug":"cve-2026-126242-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator incorrect authorization in API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.893+00:00","url":"https://junglewise.ai/threats/cve-2026-126242-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126241","cvss":8.8,"slug":"cve-2026-126241-a-improper-neutralization-of-special-elements-used-in-an-sql","title":"Fortinet FortiAuthenticator SQL injection in API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.753+00:00","url":"https://junglewise.ai/threats/cve-2026-126241-a-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-126240","cvss":8.2,"slug":"cve-2026-126240-a-improper-neutralization-of-special-elements-used-in-an-ldap","title":"Fortinet FortiAuthenticator LDAP injection authentication bypass","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.617+00:00","url":"https://junglewise.ai/threats/cve-2026-126240-a-improper-neutralization-of-special-elements-used-in-an-ldap"},{"cve":"CVE-2026-126239","cvss":7.5,"slug":"cve-2026-126239-a-stack-based-buffer-overflow-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator stack-based buffer overflow","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.46+00:00","url":"https://junglewise.ai/threats/cve-2026-126239-a-stack-based-buffer-overflow-vulnerability-in-fortinet"},{"cve":"CVE-2026-126238","cvss":8.6,"slug":"cve-2026-126238-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator incorrect authorization in REST API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.313+00:00","url":"https://junglewise.ai/threats/cve-2026-126238-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126237","cvss":7.5,"slug":"cve-2026-126237-a-loop-with-unreachable-exit-condition-infinite-loop","title":"Fortinet FortiAuthenticator infinite loop denial of service","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.177+00:00","url":"https://junglewise.ai/threats/cve-2026-126237-a-loop-with-unreachable-exit-condition-infinite-loop"},{"cve":"CVE-2026-121526","cvss":6.1,"slug":"cve-2026-121526-a-url-redirection-to-untrusted-site-open-redirect-vulnerability","title":"Fortinet FortiAuthenticator open redirect vulnerability","severity":"medium","exploited":false,"published_at":"2026-11-11T22:17:10.97+00:00","url":"https://junglewise.ai/threats/cve-2026-121526-a-url-redirection-to-untrusted-site-open-redirect-vulnerability"},{"cve":"CVE-2025-53379","cvss":7.5,"slug":"cve-2025-53379-fortinet-fortiauthenticator-out-of-bounds-read-in-gui","title":"Fortinet FortiAuthenticator out-of-bounds read in GUI","severity":"high","exploited":false,"published_at":"2026-07-14T16:16:42.477+00:00","url":"https://junglewise.ai/threats/cve-2025-53379-fortinet-fortiauthenticator-out-of-bounds-read-in-gui"},{"cve":"CVE-2026-44277","cvss":9.8,"epss":0.0006,"slug":"cve-2026-44277-fortinet-fortiauthenticator-improper-access-control-in-api","title":"Fortinet FortiAuthenticator improper access control in API","severity":"critical","exploited":false,"published_at":"2026-05-12T18:17:30.04+00:00","url":"https://junglewise.ai/threats/cve-2026-44277-fortinet-fortiauthenticator-improper-access-control-in-api"},{"cve":"CVE-2025-59923","cvss":2.7,"epss":0.0021,"slug":"cve-2025-59923-an-improper-access-control-vulnerability-in-fortinet","title":"An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5…","severity":"low","exploited":false,"published_at":"2025-12-09T18:15:55.663+00:00","url":"https://junglewise.ai/threats/cve-2025-59923-an-improper-access-control-vulnerability-in-fortinet"},{"cve":"CVE-2025-57823","cvss":2.7,"epss":0.0023,"slug":"cve-2025-57823-a-direct-request-forced-browsing-vulnerability-in-fortinet","title":"A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6…","severity":"low","exploited":false,"published_at":"2025-12-09T18:15:54.48+00:00","url":"https://junglewise.ai/threats/cve-2025-57823-a-direct-request-forced-browsing-vulnerability-in-fortinet"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":2,"exploited":0,"vulnerabilities":18}],"related":[{"name":"Fortinet FortiOS","slug":"fortios","vulnerabilities":66,"url":"https://junglewise.ai/threats/technologies/fortios"},{"name":"Fortinet FortiManager","slug":"fortimanager","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/fortimanager"},{"name":"Fortinet FortiManager Cloud","slug":"fortimanager-cloud","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/fortimanager-cloud"},{"name":"Fortinet FortiAnalyzer","slug":"fortianalyzer","vulnerabilities":47,"url":"https://junglewise.ai/threats/technologies/fortianalyzer"},{"name":"Fortinet Fortianalyzer Cloud","slug":"fortianalyzer-cloud","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/fortianalyzer-cloud"},{"name":"Fortinet FortiProxy","slug":"fortiproxy","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/fortiproxy"},{"name":"Fortinet FortiMail","slug":"fortimail","vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/fortimail"},{"name":"Fortinet FortiSandbox","slug":"fortisandbox","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/fortisandbox"},{"name":"Fortinet FortiWeb","slug":"fortiweb","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/fortiweb"},{"name":"Fortinet Fortisase","slug":"fortisase","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/fortisase"},{"name":"Fortinet FortiPAM","slug":"fortipam","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/fortipam"},{"name":"Fortinet FortiSandbox Cloud","slug":"fortisandbox-cloud","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/fortisandbox-cloud"}],"technology":{"hub":true,"name":"Fortinet FortiAuthenticator","slug":"fortiauthenticator","vendor":{"hub":true,"name":"Fortinet","slug":"fortinet","url":"https://junglewise.ai/threats/vendors/fortinet"},"aliases":[],"category":"identity-management","homepage":"https://www.fortinet.com/products/identity-access-management/fortiauthenticator","description":"Multi-factor authentication server providing identity management and access control for Fortinet environments.","url":"https://junglewise.ai/threats/technologies/fortiauthenticator"},"most_severe":[{"cve":"CVE-2026-44277","cvss":9.8,"epss":0.0006,"slug":"cve-2026-44277-fortinet-fortiauthenticator-improper-access-control-in-api","title":"Fortinet FortiAuthenticator improper access control in API","severity":"critical","exploited":false,"published_at":"2026-05-12T18:17:30.04+00:00","url":"https://junglewise.ai/threats/cve-2026-44277-fortinet-fortiauthenticator-improper-access-control-in-api"},{"cve":"CVE-2026-126251","cvss":9.1,"slug":"cve-2026-126251-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator incorrect authorization","severity":"critical","exploited":false,"published_at":"2026-11-11T22:17:25.087+00:00","url":"https://junglewise.ai/threats/cve-2026-126251-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126257","cvss":9,"slug":"cve-2026-126257-a-use-of-hard-coded-password-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator hard-coded password authentication bypass","severity":"critical","exploited":false,"published_at":"2026-11-11T22:17:25.93+00:00","url":"https://junglewise.ai/threats/cve-2026-126257-a-use-of-hard-coded-password-vulnerability-in-fortinet"},{"cve":"CVE-2026-126241","cvss":8.8,"slug":"cve-2026-126241-a-improper-neutralization-of-special-elements-used-in-an-sql","title":"Fortinet FortiAuthenticator SQL injection in API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.753+00:00","url":"https://junglewise.ai/threats/cve-2026-126241-a-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-126238","cvss":8.6,"slug":"cve-2026-126238-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator incorrect authorization in REST API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.313+00:00","url":"https://junglewise.ai/threats/cve-2026-126238-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126252","cvss":8.3,"slug":"cve-2026-126252-a-improper-neutralization-of-special-elements-used-in-an-sql","title":"Fortinet FortiAuthenticator SQL injection","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:25.22+00:00","url":"https://junglewise.ai/threats/cve-2026-126252-a-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-126250","cvss":8.2,"slug":"cve-2026-126250-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator authorization bypass DoS","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.96+00:00","url":"https://junglewise.ai/threats/cve-2026-126250-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126240","cvss":8.2,"slug":"cve-2026-126240-a-improper-neutralization-of-special-elements-used-in-an-ldap","title":"Fortinet FortiAuthenticator LDAP injection authentication bypass","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:23.617+00:00","url":"https://junglewise.ai/threats/cve-2026-126240-a-improper-neutralization-of-special-elements-used-in-an-ldap"},{"cve":"CVE-2026-126245","cvss":8.1,"slug":"cve-2026-126245-a-out-of-bounds-write-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator out-of-bounds write in API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.28+00:00","url":"https://junglewise.ai/threats/cve-2026-126245-a-out-of-bounds-write-vulnerability-in-fortinet"},{"cve":"CVE-2026-126248","cvss":7.5,"slug":"cve-2026-126248-a-insufficiently-protected-credentials-vulnerability-in-fortinet","title":"Fortinet FortiAuthenticator insufficiently protected credentials","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:24.693+00:00","url":"https://junglewise.ai/threats/cve-2026-126248-a-insufficiently-protected-credentials-vulnerability-in-fortinet"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}