{"id":"CVE-2026-126241","kind":"vulnerability","aliases":["CVE-2026-126241"],"related":[],"title":"FortiAuthenticator: SQL injection lets a logged-in user run database commands","description":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database.","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 fail to neutralize special characters in SQL queries. An authenticated attacker can run unauthorized SQL commands against the underlying database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4"],"affected":">= 8.0.0, <= 8.0.3","ecosystem":"vendor"},{"name":"FortiAuthenticator","fixed":["6.6.11"],"affected":">= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortiauthenticator","fortinet","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"In the FortiAuthenticator admin GUI (Dashboard > system information) or CLI, read the firmware version. Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. Fortinet lists no workaround.","status":"open","published_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:31:18+00:00","updated_at":"2026-11-11T22:37:33+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:31:18Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"FortiAuthenticator: SQL injection lets a logged-in user run database commands","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 fail to neutralize special characters in SQL queries. An authenticated attacker can run unauthorized SQL commands against the underlying database.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads or changes the authentication database","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126241 to confirm the fixed versions and any workaround; the NVD entry alone does not state a fix.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface and compare it with the affected ranges: `8.0.0` through `8.0.3`, and `6.6.0` through `6.6.10`.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 to 8.0.3 or 6.6.0 to 6.6.10 are exposed. The attacker needs an account on the appliance, so exposure depends on who can log in to it. Sources do not say which configurations are affected beyond the version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4565,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126241 to confirm the fixed versions and any workaround; the NVD entry alone does not state a fix.","search":"'-126241':15A,18A '-2026':14A,17A '6.6.0':32B,76C '6.6.10':34B,78C '8.0.0':28B,72C '8.0.3':30B,74C 'allow':80C 'attack':45B,83C 'authent':44B,82C 'charact':39B 'command':12A,50B,65C,88C 'cve':13A,16A 'databas':11A,54B,92C 'element':60C 'execut':85C 'fail':35B 'fortiauthent':1A,21B,27B,71C,75C 'fortiauthenticator':19A,20A 'fortinet':22B,70C 'host':25B 'improp':56C 'inject':3A,67C 'let':4A 'log':7A 'logged-in':6A 'may':79C 'neutral':37B,57C 'queri':42B 'run':10A,47B 'self':24B 'self-host':23B 'special':38B,59C 'sql':2A,41B,49B,64C,66C,87C 'unauthor':48B,86C 'under':53B,91C 'use':61C 'user':9A 'vendor':26B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted FortiAuthenticator on 8.0.0 to 8.0.3 or 6.6.0 to 6.6.10. The attacker needs a valid authenticated account on the appliance (API component), so exposure depends on who can log in. Nobody on 8.0.4+ or 6.6.11+ is affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:37:33Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256","run_id":3624},"products":{"at":"2026-11-11T22:37:33Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256","run_id":3624},"how_to_check":{"at":"2026-11-11T22:37:33Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256","run_id":3624},"who_affected":{"at":"2026-11-11T22:37:33Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256","run_id":3624}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["fortiauthenticator","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126241':15A,18A '-2026':14A,17A 'command':12A 'cve':13A,16A 'databas':11A 'fortiauthent':1A 'fortiauthenticator':19A,20A 'inject':3A 'let':4A 'log':7A 'logged-in':6A 'run':10A 'sql':2A 'user':9A","search_b":"'6.6.0':32B '6.6.10':34B '8.0.0':28B '8.0.3':30B 'attack':45B 'authent':44B 'charact':39B 'command':50B 'databas':54B 'fail':35B 'fortiauthent':21B,27B 'fortinet':22B 'host':25B 'neutral':37B 'queri':42B 'run':47B 'self':24B 'self-host':23B 'special':38B 'sql':41B,49B 'unauthor':48B 'under':53B 'vendor':26B","search_c":"'6.6.0':76C '6.6.10':78C '8.0.0':72C '8.0.3':74C 'allow':80C 'attack':83C 'authent':82C 'command':65C,88C 'databas':92C 'element':60C 'execut':85C 'fortiauthent':71C,75C 'fortinet':70C 'improp':56C 'inject':67C 'may':79C 'neutral':57C 'special':59C 'sql':64C,66C,87C 'unauthor':86C 'under':91C 'use':61C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126241","severity":null,"published_at":"2026-11-11T22:17:23+00:00","modified_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126241:3624","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256","severity":null,"published_at":"2026-11-11T22:37:33+00:00","modified_at":"2026-11-11T22:37:33+00:00","first_seen_at":"2026-11-11T22:37:33+00:00","fetched_at":"2026-11-11T22:37:33+00:00","note":"Read Fortinet PSIRT FG-IR-26-256: fixed in 8.0.4 and 6.6.11; no workaround or virtual patch listed; not known exploited; internal discovery.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-256"]}],"documents":[{"id":129668,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256","title":"Fortinet PSIRT FG-IR-26-256: SQL injection in FortiAuthenticator","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}