{"id":"CVE-2026-126245","kind":"vulnerability","aliases":["CVE-2026-126245"],"related":[],"title":"Fortinet FortiAuthenticator: out-of-bounds write lets unauthenticated attackers run code","description":"A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections.","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an out-of-bounds write reachable over HTTP. An unauthenticated attacker who can defeat ASLR may execute unauthorized code or commands on the appliance.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fortiauthenticator","fortinet","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the FortiAuthenticator version in the admin interface and compare it with the affected ranges (`8.0.0` to `8.0.3`, `6.6.0` to `6.6.10`).","fix":"- Move to a fixed release; the sources do not name the fixed version.","status":"open","published_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:31:45+00:00","updated_at":"2026-11-11T22:31:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:31:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release; the sources do not name the fixed version.","reach":"internet","title":"Fortinet FortiAuthenticator: out-of-bounds write lets unauthenticated attackers run code","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an out-of-bounds write reachable over HTTP. An unauthenticated attacker who can defeat ASLR may execute unauthorized code or commands on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs unauthorized code on the appliance after defeating ASLR.","analyst_note":"Find the vendor advisory and the fixed FortiAuthenticator versions for the 8.0.x and 6.6.x branches, and confirm whether ASLR bypass is a practical precondition.","how_to_check":"- Check the FortiAuthenticator version in the admin interface and compare it with the affected ranges (`8.0.0` to `8.0.3`, `6.6.0` to `6.6.10`).\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"FortiAuthenticator","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 with the HTTP interface reachable by attackers. The sources do not say which features or configurations are required, so the exposure of any given appliance is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4591,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126245':15A,18A '-2026':14A,17A '6.6.0':31B,74C '6.6.10':33B,76C '8.0.0':27B,70C '8.0.3':29B,72C 'abl':95C 'allow':78C 'applianc':59B 'aslr':50B,98C 'attack':10A,46B,81C,93C 'bound':6A,39B,64C 'code':12A,54B,85C 'command':56B,87C 'contain':34B 'cve':13A,16A 'defeat':49B,97C 'execut':52B,83C 'fortiauthent':2A,20B,26B,69C,73C 'fortiauthenticator':19A 'fortinet':1A,21B,68C 'host':25B 'http':43B,89C 'infrastructur':22B 'let':8A 'may':51B,77C 'out-of-bound':3A,36B,61C 'protect':99C 'reachabl':41B 'request':90C 'run':11A 'self':24B 'self-host':23B 'unauthent':9A,45B,80C 'unauthor':53B,84C 'via':88C 'vulner':66C 'write':7A,40B,65C","nicknames":[],"mitigations":[],"who_affected":"Organisations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 with the HTTP interface reachable by attackers. The sources do not say which features or configurations are required, so the exposure of any given appliance is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["fortiauthenticator","fortinet","high","infrastructure","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126245':15A,18A '-2026':14A,17A 'attack':10A 'bound':6A 'code':12A 'cve':13A,16A 'fortiauthent':2A 'fortiauthenticator':19A 'fortinet':1A 'let':8A 'out-of-bound':3A 'run':11A 'unauthent':9A 'write':7A","search_b":"'6.6.0':31B '6.6.10':33B '8.0.0':27B '8.0.3':29B 'applianc':59B 'aslr':50B 'attack':46B 'bound':39B 'code':54B 'command':56B 'contain':34B 'defeat':49B 'execut':52B 'fortiauthent':20B,26B 'fortinet':21B 'host':25B 'http':43B 'infrastructur':22B 'may':51B 'out-of-bound':36B 'reachabl':41B 'self':24B 'self-host':23B 'unauthent':45B 'unauthor':53B 'write':40B","search_c":"'6.6.0':74C '6.6.10':76C '8.0.0':70C '8.0.3':72C 'abl':95C 'allow':78C 'aslr':98C 'attack':81C,93C 'bound':64C 'code':85C 'command':87C 'defeat':97C 'execut':83C 'fortiauthent':69C,73C 'fortinet':68C 'http':89C 'may':77C 'out-of-bound':61C 'protect':99C 'request':90C 'unauthent':80C 'unauthor':84C 'via':88C 'vulner':66C 'write':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126245","severity":null,"published_at":"2026-11-11T22:17:24+00:00","modified_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}