FORTIAUTHENTICATOR · CVE-2026-126239 · Vendor
FIX → 8.0.4 · 6.6.11 ✓ verified
A stack-based buffer overflow in FortiAuthenticator's FSSO subsystem can be triggered by crafted HTTP requests. An unauthenticated attacker can crash the subsystem, causing a denial of service.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. An unauthenticated attacker who can send crafted HTTP requests to the appliance can crash the FSSO subsystem (Fortinet's text), so exposure depends on who can reach its HTTP interface. Fortinet's page does not say whether FSSO must be enabled; its impact line also mentions code execution, while the description says crash only. Other FortiAuthenticator versions are not listed as affected.
Not affected if unknown
Who cares appliance, fortiauthenticator, fortinet, fsso, unauthenticated
get system status in the CLI)8.0.0 through 8.0.3 or 6.6.0 through 6.6.10A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.4 · 6.6.11
Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above.