{"id":"CVE-2026-126239","kind":"vulnerability","aliases":["CVE-2026-126239"],"related":[],"title":"Fortinet FortiAuthenticator: crafted HTTP requests can crash the FSSO subsystem","description":"A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests","summary":"A stack-based buffer overflow in FortiAuthenticator's FSSO subsystem can be triggered by crafted HTTP requests. An unauthenticated attacker can crash the subsystem, causing a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4"],"affected":">= 8.0.0, <= 8.0.3","ecosystem":"vendor"},{"name":"FortiAuthenticator","fixed":["6.6.11"],"affected":">= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","fortiauthenticator","fortinet","fsso","unauthenticated","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check the FortiAuthenticator firmware version (admin GUI dashboard, or 'get system status' in the CLI). Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. Fortinet does not say FSSO must be enabled, so treat any appliance in those ranges as affected; also check whether its HTTP interface is reachable from untrusted networks.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above.","status":"open","published_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:32:03+00:00","updated_at":"2026-11-11T22:37:37+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:32:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAuthenticator: crafted HTTP requests can crash the FSSO subsystem","impact":"low","summary":"A stack-based buffer overflow in FortiAuthenticator's FSSO subsystem can be triggered by crafted HTTP requests. An unauthenticated attacker can crash the subsystem, causing a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortiauthenticator","fortinet","fsso","appliance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker crashes the FSSO subsystem, causing denial of service","analyst_note":"Confirm the fixed versions and any FSSO-enablement condition from Fortinet's PSIRT advisory; NVD text alone does not state a fix.","how_to_check":"- Check the FortiAuthenticator firmware version under the admin GUI dashboard or via the vendor's CLI, and compare against the affected ranges 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.\n- unknown for whether FSSO is enabled in your deployment; the sources do not say how to check it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are in the affected ranges. The sources describe the flaw as reachable with crafted HTTP requests and say no authentication is needed, so exposure depends on whether the appliance's HTTP interface is reachable by the attacker. unknown whether the FSSO subsystem must be enabled to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4573,"output_tokens":665,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any FSSO-enablement condition from Fortinet's PSIRT advisory; NVD text alone does not state a fix.","search":"'-126239':13A,16A '-2026':12A,15A '6.6.0':69C '6.6.10':71C '8.0.0':65C '8.0.3':67C 'allow':73C 'applianc':19B 'attack':45B,76C 'base':28B,58C 'buffer':29B,59C 'caus':50B 'craft':3A,40B,83C 'crash':7A,47B,78C 'cve':11A,14A 'denial':52B 'fortiauthent':2A,20B,32B,64C,68C 'fortiauthenticator':17A,18A 'fortinet':1A,21B,63C 'fsso':9A,22B,34B,80C 'http':4A,41B,84C 'may':72C 'overflow':30B,60C 'request':5A,42B,85C 'servic':54B 'stack':27B,57C 'stack-bas':26B,56C 'subsystem':10A,35B,49B,81C 'trigger':38B 'unauthent':23B,44B,75C 'vendor':24B 'via':82C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. An unauthenticated attacker who can send crafted HTTP requests to the appliance can crash the FSSO subsystem (Fortinet's text), so exposure depends on who can reach its HTTP interface. Fortinet's page does not say whether FSSO must be enabled; its impact line also mentions code execution, while the description says crash only. Other FortiAuthenticator versions are not listed as affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:37:37Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-254","run_id":3625},"products":{"at":"2026-11-11T22:37:37Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-254","run_id":3625}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["appliance","fortiauthenticator","fortinet","fsso","high","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-126239':13A,16A '-2026':12A,15A 'craft':3A 'crash':7A 'cve':11A,14A 'fortiauthent':2A 'fortiauthenticator':17A,18A 'fortinet':1A 'fsso':9A 'http':4A 'request':5A 'subsystem':10A","search_b":"'applianc':19B 'attack':45B 'base':28B 'buffer':29B 'caus':50B 'craft':40B 'crash':47B 'denial':52B 'fortiauthent':20B,32B 'fortinet':21B 'fsso':22B,34B 'http':41B 'overflow':30B 'request':42B 'servic':54B 'stack':27B 'stack-bas':26B 'subsystem':35B,49B 'trigger':38B 'unauthent':23B,44B 'vendor':24B","search_c":"'6.6.0':69C '6.6.10':71C '8.0.0':65C '8.0.3':67C 'allow':73C 'attack':76C 'base':58C 'buffer':59C 'craft':83C 'crash':78C 'fortiauthent':64C,68C 'fortinet':63C 'fsso':80C 'http':84C 'may':72C 'overflow':60C 'request':85C 'stack':57C 'stack-bas':56C 'subsystem':81C 'unauthent':75C 'via':82C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126239","severity":null,"published_at":"2026-11-11T22:17:23+00:00","modified_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126239:3625","url":"https://www.fortiguard.com/psirt/FG-IR-26-254","severity":null,"published_at":"2026-11-11T22:37:37+00:00","modified_at":"2026-11-11T22:37:37+00:00","first_seen_at":"2026-11-11T22:37:37+00:00","fetched_at":"2026-11-11T22:37:37+00:00","note":"Read Fortinet PSIRT FG-IR-26-254 (via search snippet of the page): affected 8.0.0-8.0.3 and 6.6.0-6.6.10, fixed 8.0.4 / 6.6.11; unauthenticated, not known exploited, no virtual patch. Advisory does not say whether FSSO must be enabled; its impact line says code execution but the text says crash. NVD page unreadable. No social search done.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-254"]}],"documents":[{"id":129669,"url":"https://www.fortiguard.com/psirt/FG-IR-26-254","title":"Fortinet PSIRT FG-IR-26-254: Stack-based buffer overflow (FortiAuthenticator)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}