FORTIAUTHENTICATOR · CVE-2026-126241 · Vendor
FIX → 8.0.4 · 6.6.11 ✓ verified
FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 fail to neutralize special characters in SQL queries. An authenticated attacker can run unauthorized SQL commands against the underlying database.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running a self-hosted FortiAuthenticator on 8.0.0 to 8.0.3 or 6.6.0 to 6.6.10. The attacker needs a valid authenticated account on the appliance (API component), so exposure depends on who can log in. Nobody on 8.0.4+ or 6.6.11+ is affected.
Not affected if unknown
Who cares fortiauthenticator, fortinet, self-hosted
8.0.0 through 8.0.3 or 6.6.0 through 6.6.10A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.4 · 6.6.11
8.0.4 or above; 6.6.x to 6.6.11 or above