---
id: "CVE-2026-126244"
page: "https://infrastack.ai/live/CVE-2026-126244"
kind: "vulnerability"
aliases: ["CVE-2026-126244"]
title: "Fortinet FortiAuthenticator: unauthenticated resource exhaustion causes denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fortiauthenticator", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["other-versions"]
published_at: "2026-11-11T22:17:24+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:32:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126244", "first_seen_at": "2026-11-11T22:29:32+00:00"}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: unauthenticated resource exhaustion causes denial of service

Link for people: https://infrastack.ai/live/CVE-2026-126244 (this .md is for agents)

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 lack limits on resource allocation. An unauthenticated attacker can exhaust system resources and knock the appliance offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FortiAuthenticator version against the affected ranges 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 in the admin interface.

## Fix

- FortiAuthenticator 8.0.0 through 8.0.3: unknown
- FortiAuthenticator 6.6.0 through 6.6.10: unknown

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126244

## From the sources

A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_