{"id":"CVE-2026-126237","kind":"vulnerability","aliases":["CVE-2026-126237"],"related":[],"title":"Fortinet FortiAuthenticator: crafted TCP requests can hang the appliance","description":"A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to cause a denial of service via crafted TCP requests.","summary":"FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an infinite loop that crafted TCP requests can trigger. An attacker can use this to cause a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortiauthenticator","fortinet","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed FortiAuthenticator version in the admin interface or with `get system status` on the appliance.\n- Compare it against the affected ranges: `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10`.","fix":"- Fixed versions are not stated in the sources.","status":"open","published_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:32:03+00:00","updated_at":"2026-11-11T22:32:03+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:32:03Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed versions are not stated in the sources.","reach":"network","title":"Fortinet FortiAuthenticator: crafted TCP requests can hang the appliance","impact":"low","summary":"FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an infinite loop that crafted TCP requests can trigger. An attacker can use this to cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker stalls the appliance with crafted TCP requests, causing denial of service","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126237 to confirm the fixed versions and which TCP service is affected.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface or with `get system status` on the appliance.\n- Compare it against the affected ranges: `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"FortiAuthenticator appliances in the affected version ranges that accept TCP traffic from the network are exposed. Sources do not say whether a default configuration or a specific service must be enabled. Teams running other Fortinet products or versions outside these ranges can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4568,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126237':12A,15A '-2026':11A,14A '6.6.0':28B,68C '6.6.10':30B,70C '8.0.0':24B,64C '8.0.3':26B,66C 'allow':72C 'applianc':9A 'attack':42B,74C 'caus':47B,76C 'condit':57C 'contain':31B 'craft':3A,36B,82C 'cve':10A,13A 'denial':49B,78C 'exit':56C 'fortiauthent':2A,16B,22B,63C,67C 'fortinet':1A,17B,62C 'hang':7A 'host':20B 'infinit':33B,58C 'loop':34B,53C,59C 'may':71C 'request':5A,38B,84C 'self':19B 'self-host':18B 'servic':51B,80C 'tcp':4A,37B,83C 'trigger':40B 'unreach':55C 'use':44B 'vendor':21B 'version':23B 'via':81C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"FortiAuthenticator appliances in the affected version ranges that accept TCP traffic from the network are exposed. Sources do not say whether a default configuration or a specific service must be enabled. Teams running other Fortinet products or versions outside these ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortiauthenticator","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126237':12A,15A '-2026':11A,14A 'applianc':9A 'craft':3A 'cve':10A,13A 'fortiauthent':2A 'fortinet':1A 'hang':7A 'request':5A 'tcp':4A","search_b":"'6.6.0':28B '6.6.10':30B '8.0.0':24B '8.0.3':26B 'attack':42B 'caus':47B 'contain':31B 'craft':36B 'denial':49B 'fortiauthent':16B,22B 'fortinet':17B 'host':20B 'infinit':33B 'loop':34B 'request':38B 'self':19B 'self-host':18B 'servic':51B 'tcp':37B 'trigger':40B 'use':44B 'vendor':21B 'version':23B","search_c":"'6.6.0':68C '6.6.10':70C '8.0.0':64C '8.0.3':66C 'allow':72C 'attack':74C 'caus':76C 'condit':57C 'craft':82C 'denial':78C 'exit':56C 'fortiauthent':63C,67C 'fortinet':62C 'infinit':58C 'loop':53C,59C 'may':71C 'request':84C 'servic':80C 'tcp':83C 'unreach':55C 'via':81C 'vulner':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126237","severity":null,"published_at":"2026-11-11T22:17:23+00:00","modified_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}