{"id":"CVE-2026-126247","kind":"vulnerability","aliases":["CVE-2026-126247"],"related":[],"title":"Fortinet FortiAuthenticator: format string flaw lets admins run unauthorized code","description":"A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests.","summary":"A format string flaw in Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 can be triggered through crafted HTTP requests. An authenticated privileged attacker may be able to execute unauthorized code or commands on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4","6.6.11"],"affected":">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortiauthenticator","fortinet","identity","infrastructure","self-hosted"],"not_affected_if":["auth-required","no-privileged-accounts-exposed","versions-outside-range"],"how_to_check":"Check the FortiAuthenticator firmware version in the admin GUI (dashboard / System Information) or CLI 'get system status'. Affected: 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. Exploitation needs an authenticated privileged administrator, so also review who holds admin accounts and who can reach the admin interface.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. Fortinet lists no workaround or virtual patch.","status":"open","published_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:33:16+00:00","updated_at":"2026-11-11T22:36:45+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:33:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAuthenticator: format string flaw lets admins run unauthorized code","impact":"high","summary":"A format string flaw in Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 can be triggered through crafted HTTP requests. An authenticated privileged attacker may be able to execute unauthorized code or commands on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"privileged attacker executes unauthorized code on the appliance","analyst_note":"Fetch the Fortinet PSIRT advisory for CVE-2026-126247 to confirm the fixed versions and any workaround; the NVD entry gives no fix.","how_to_check":"- Check the FortiAuthenticator firmware version in the admin GUI or with the vendor's version command, and compare it with `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10`.\n- Review which accounts have privileged administrator rights on the appliance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-range","no-privileged-accounts-exposed"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are in the affected range. The attacker must hold an authenticated privileged account and send HTTP requests to the appliance, so exposure depends on who has admin access and whether the management interface is reachable from untrusted networks. unknown whether other versions or configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000788,"input_tokens":4563,"output_tokens":664,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fetch the Fortinet PSIRT advisory for CVE-2026-126247 to confirm the fixed versions and any workaround; the NVD entry gives no fix.","search":"'-126247':13A,16A '-2026':12A,15A '6.6.0':36B,78C '6.6.10':38B,80C '8.0.0':32B,74C '8.0.3':34B,76C 'abl':52B 'admin':7A 'allow':82C 'applianc':61B 'attack':49B,86C 'authent':47B,84C 'code':10A,56B,90C 'command':58B,92C 'control':67C 'craft':43B 'cve':11A,14A 'execut':54B,88C 'extern':66C 'externally-control':65C 'flaw':5A,28B 'format':3A,26B,68C 'fortiauthent':2A,18B,31B,73C,77C 'fortiauthenticator':17A 'fortinet':1A,19B,30B,72C 'host':24B 'http':44B,94C 'ident':20B 'infrastructur':21B 'let':6A 'may':50B,81C 'privileg':48B,85C 'request':45B,95C 'run':8A 'self':23B 'self-host':22B 'string':4A,27B,69C 'trigger':41B 'unauthor':9A,55B,89C 'use':63C 'via':93C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FortiAuthenticator appliances on 8.0.0-8.0.3 or 6.6.0-6.6.10. The flaw is in the API/HTTP handling and needs an authenticated privileged account, so the risk is mainly a compromised or malicious admin. Teams without FortiAuthenticator, or on 8.0.4 / 6.6.11 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:36:45Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-261","run_id":3621},"products":{"at":"2026-11-11T22:36:45Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-261","run_id":3621},"how_to_check":{"at":"2026-11-11T22:36:45Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-261","run_id":3621},"who_affected":{"at":"2026-11-11T22:36:45Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-261","run_id":3621}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["fortiauthenticator","fortinet","high","identity","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126247':13A,16A '-2026':12A,15A 'admin':7A 'code':10A 'cve':11A,14A 'flaw':5A 'format':3A 'fortiauthent':2A 'fortiauthenticator':17A 'fortinet':1A 'let':6A 'run':8A 'string':4A 'unauthor':9A","search_b":"'6.6.0':36B '6.6.10':38B '8.0.0':32B '8.0.3':34B 'abl':52B 'applianc':61B 'attack':49B 'authent':47B 'code':56B 'command':58B 'craft':43B 'execut':54B 'flaw':28B 'format':26B 'fortiauthent':18B,31B 'fortinet':19B,30B 'host':24B 'http':44B 'ident':20B 'infrastructur':21B 'may':50B 'privileg':48B 'request':45B 'self':23B 'self-host':22B 'string':27B 'trigger':41B 'unauthor':55B","search_c":"'6.6.0':78C '6.6.10':80C '8.0.0':74C '8.0.3':76C 'allow':82C 'attack':86C 'authent':84C 'code':90C 'command':92C 'control':67C 'execut':88C 'extern':66C 'externally-control':65C 'format':68C 'fortiauthent':73C,77C 'fortinet':72C 'http':94C 'may':81C 'privileg':85C 'request':95C 'string':69C 'unauthor':89C 'use':63C 'via':93C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126247","severity":null,"published_at":"2026-11-11T22:17:24+00:00","modified_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126247:3621","url":"https://www.fortiguard.com/psirt/FG-IR-26-261","severity":null,"published_at":"2026-11-11T22:36:45+00:00","modified_at":"2026-11-11T22:36:45+00:00","first_seen_at":"2026-11-11T22:36:45+00:00","fetched_at":"2026-11-11T22:36:45+00:00","note":"Read Fortinet PSIRT FG-IR-26-261 (via search text of the page): fix 8.0.4 / 6.6.11, no workaround listed, virtual patch No, not known exploited, found internally.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-261"]}],"documents":[{"id":129665,"url":"https://www.fortiguard.com/psirt/FG-IR-26-261","title":"FG-IR-26-261 Use of externally-controlled format string (FortiAuthenticator)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}