---
id: "CVE-2026-126245"
page: "https://infrastack.ai/live/CVE-2026-126245"
kind: "vulnerability"
aliases: ["CVE-2026-126245"]
title: "Fortinet FortiAuthenticator: out-of-bounds write lets unauthenticated attackers run code"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAuthenticator", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fortiauthenticator", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-11T22:17:24+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:31:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126245", "first_seen_at": "2026-11-11T22:29:32+00:00"}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: out-of-bounds write lets unauthenticated attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-126245 (this .md is for agents)

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an out-of-bounds write reachable over HTTP. An unauthenticated attacker who can defeat ASLR may execute unauthorized code or commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected range not listed fixed no fixed version listed

## How to check

- Check the FortiAuthenticator version in the admin interface and compare it with the affected ranges (`8.0.0` to `8.0.3`, `6.6.0` to `6.6.10`).

## Fix

- Move to a fixed release; the sources do not name the fixed version.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126245

## From the sources

A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_