---
id: "CVE-2026-126239"
page: "https://infrastack.ai/live/CVE-2026-126239"
kind: "vulnerability"
aliases: ["CVE-2026-126239"]
title: "Fortinet FortiAuthenticator: crafted HTTP requests can crash the FSSO subsystem"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4"], "affected": ">= 8.0.0, <= 8.0.3", "ecosystem": "vendor"}, {"name": "FortiAuthenticator", "fixed": ["6.6.11"], "affected": ">= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["appliance", "fortiauthenticator", "fortinet", "fsso", "unauthenticated", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-11T22:17:23+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:37:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126239", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-254", "first_seen_at": "2026-11-11T22:37:37+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-254"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: crafted HTTP requests can crash the FSSO subsystem

Link for people: https://infrastack.ai/live/CVE-2026-126239 (this .md is for agents)

A stack-based buffer overflow in FortiAuthenticator's FSSO subsystem can be triggered by crafted HTTP requests. An unauthenticated attacker can crash the subsystem, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3 fixed 8.0.4
- vendor:FortiAuthenticator affected >= 6.6.0, <= 6.6.10 fixed 6.6.11

## How to check

Check the FortiAuthenticator firmware version (admin GUI dashboard, or 'get system status' in the CLI). Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. Fortinet does not say FSSO must be enabled, so treat any appliance in those ranges as affected; also check whether its HTTP interface is reachable from untrusted networks.

## Fix

Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126239
- 2026-11-11T22:37:37+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-254 — Read Fortinet PSIRT FG-IR-26-254 (via search snippet of the page): affected 8.0.0-8.0.3 and 6.6.0-6.6.10, fixed 8.0.4 / 6.6.11; unauthenticated, not known exploited, no virtual patch. Advisory does not say whether FSSO must be enabled; its impact line says code execution but the text says crash. NVD page unreadable. No social search done.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-254: Stack-based buffer overflow (FortiAuthenticator) https://www.fortiguard.com/psirt/FG-IR-26-254

## From the sources

A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_