---
id: "CVE-2026-126241"
page: "https://infrastack.ai/live/CVE-2026-126241"
kind: "vulnerability"
aliases: ["CVE-2026-126241"]
title: "FortiAuthenticator: SQL injection lets a logged-in user run database commands"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4"], "affected": ">= 8.0.0, <= 8.0.3", "ecosystem": "vendor"}, {"name": "FortiAuthenticator", "fixed": ["6.6.11"], "affected": ">= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortiauthenticator", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-11T22:17:23+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:37:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126241", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-256", "first_seen_at": "2026-11-11T22:37:33+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-256"]}]
exploit_sources: []
---

# FortiAuthenticator: SQL injection lets a logged-in user run database commands

Link for people: https://infrastack.ai/live/CVE-2026-126241 (this .md is for agents)

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 fail to neutralize special characters in SQL queries. An authenticated attacker can run unauthorized SQL commands against the underlying database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3 fixed 8.0.4
- vendor:FortiAuthenticator affected >= 6.6.0, <= 6.6.10 fixed 6.6.11

## How to check

In the FortiAuthenticator admin GUI (Dashboard > system information) or CLI, read the firmware version. Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10.

## Fix

Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. Fortinet lists no workaround.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126241
- 2026-11-11T22:37:33+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-256 — Read Fortinet PSIRT FG-IR-26-256: fixed in 8.0.4 and 6.6.11; no workaround or virtual patch listed; not known exploited; internal discovery.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-256: SQL injection in FortiAuthenticator https://fortiguard.fortinet.com/psirt/FG-IR-26-256

## From the sources

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_