{"id":"CVE-2026-126244","kind":"vulnerability","aliases":["CVE-2026-126244"],"related":[],"title":"Fortinet FortiAuthenticator: unauthenticated resource exhaustion causes denial of service","description":"A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS).","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 lack limits on resource allocation. An unauthenticated attacker can exhaust system resources and knock the appliance offline.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortiauthenticator","fortinet","infrastructure","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed FortiAuthenticator version against the affected ranges 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 in the admin interface.","fix":"- FortiAuthenticator 8.0.0 through 8.0.3: unknown\n- FortiAuthenticator 6.6.0 through 6.6.10: unknown","status":"open","published_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:32:02+00:00","updated_at":"2026-11-11T22:32:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-11T22:32:02Z","model":"claude-haiku-5-5","output":{"fix":"- FortiAuthenticator 8.0.0 through 8.0.3: unknown\n- FortiAuthenticator 6.6.0 through 6.6.10: unknown","reach":"network","title":"Fortinet FortiAuthenticator: unauthenticated resource exhaustion causes denial of service","impact":"low","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 lack limits on resource allocation. An unauthenticated attacker can exhaust system resources and knock the appliance offline.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker exhausts resources, causing denial of service","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126244 to confirm the fixed versions and any setting that changes exposure; the NVD entry does not state them.","how_to_check":"- Check the installed FortiAuthenticator version against the affected ranges 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 in the admin interface.\n- unknown for other checks: the sources do not say which endpoint or setting is involved.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"FortiAuthenticator appliances running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are in scope, and the NVD entry gives no further detail on which deployment or feature is needed. Teams running other FortiAuthenticator versions or no FortiAuthenticator can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000787,"input_tokens":4570,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126244':12A,15A '-2026':11A,14A '6.6.0':27B,63C '6.6.10':29B,65C '8.0.0':23B,59C '8.0.3':25B,61C 'alloc':34B,48C 'allow':67C 'applianc':45B 'attack':37B,70C 'caus':6A 'cve':10A,13A 'denial':7A,79C 'dos':82C 'exhaust':5A,39B,72C 'fortiauthent':2A,16B,22B,58C,62C 'fortinet':1A,17B,57C 'host':21B 'infrastructur':18B 'knock':43B 'lack':30B 'limit':31B,52C 'may':66C 'offlin':46B 'potenti':75C 'resourc':4A,33B,41B,50C,74C 'result':76C 'self':20B 'self-host':19B 'servic':9A,81C 'system':40B,73C 'throttl':54C 'unauthent':3A,36B,69C 'vulner':55C 'without':51C","nicknames":[],"mitigations":[],"who_affected":"FortiAuthenticator appliances running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are in scope, and the NVD entry gives no further detail on which deployment or feature is needed. Teams running other FortiAuthenticator versions or no FortiAuthenticator can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortiauthenticator","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126244':12A,15A '-2026':11A,14A 'caus':6A 'cve':10A,13A 'denial':7A 'exhaust':5A 'fortiauthent':2A 'fortinet':1A 'resourc':4A 'servic':9A 'unauthent':3A","search_b":"'6.6.0':27B '6.6.10':29B '8.0.0':23B '8.0.3':25B 'alloc':34B 'applianc':45B 'attack':37B 'exhaust':39B 'fortiauthent':16B,22B 'fortinet':17B 'host':21B 'infrastructur':18B 'knock':43B 'lack':30B 'limit':31B 'offlin':46B 'resourc':33B,41B 'self':20B 'self-host':19B 'system':40B 'unauthent':36B","search_c":"'6.6.0':63C '6.6.10':65C '8.0.0':59C '8.0.3':61C 'alloc':48C 'allow':67C 'attack':70C 'denial':79C 'dos':82C 'exhaust':72C 'fortiauthent':58C,62C 'fortinet':57C 'limit':52C 'may':66C 'potenti':75C 'resourc':50C,74C 'result':76C 'servic':81C 'system':73C 'throttl':54C 'unauthent':69C 'vulner':55C 'without':51C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126244","severity":null,"published_at":"2026-11-11T22:17:24+00:00","modified_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}