---
id: "CVE-2026-126247"
page: "https://infrastack.ai/live/CVE-2026-126247"
kind: "vulnerability"
aliases: ["CVE-2026-126247"]
title: "Fortinet FortiAuthenticator: format string flaw lets admins run unauthorized code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4", "6.6.11"], "affected": ">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortiauthenticator", "fortinet", "identity", "infrastructure", "self-hosted"]
not_affected_if: ["auth-required", "no-privileged-accounts-exposed", "versions-outside-range"]
published_at: "2026-11-11T22:17:24+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:36:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126247", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-261", "first_seen_at": "2026-11-11T22:36:45+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-261"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: format string flaw lets admins run unauthorized code

Link for people: https://infrastack.ai/live/CVE-2026-126247 (this .md is for agents)

A format string flaw in Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 can be triggered through crafted HTTP requests. An authenticated privileged attacker may be able to execute unauthorized code or commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10 fixed 8.0.4, 6.6.11

## How to check

Check the FortiAuthenticator firmware version in the admin GUI (dashboard / System Information) or CLI 'get system status'. Affected: 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. Exploitation needs an authenticated privileged administrator, so also review who holds admin accounts and who can reach the admin interface.

## Fix

Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. Fortinet lists no workaround or virtual patch.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126247
- 2026-11-11T22:36:45+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-261 — Read Fortinet PSIRT FG-IR-26-261 (via search text of the page): fix 8.0.4 / 6.6.11, no workaround listed, virtual patch No, not known exploited, found internally.

## Documents

- [advisory] FG-IR-26-261 Use of externally-controlled format string (FortiAuthenticator) https://www.fortiguard.com/psirt/FG-IR-26-261

## From the sources

A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_