CVE-2026-126247

CVSS 7.2 (high) · published 2026-11-11

A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests.

Weakness: CWE-134

Source: NVD CVE-2026-126247

References

• https://fortiguard.fortinet.com/psirt/FG-IR-26-261

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.