---
id: "CVE-2026-126249"
page: "https://infrastack.ai/live/CVE-2026-126249"
kind: "vulnerability"
aliases: ["CVE-2026-126249"]
title: "Fortinet FortiAuthenticator: authenticated users can escalate their privileges"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4"], "affected": ">= 8.0.0, <= 8.0.3", "ecosystem": "vendor"}, {"name": "FortiAuthenticator 6.6", "fixed": ["6.6.11"], "affected": ">= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortiauthenticator", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["no-fortiauthenticator-in-range"]
published_at: "2026-11-11T22:17:24+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:36:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126249", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-263", "first_seen_at": "2026-11-11T22:36:35+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-263"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: authenticated users can escalate their privileges

Link for people: https://infrastack.ai/live/CVE-2026-126249 (this .md is for agents)

FortiAuthenticator, Fortinet's identity and authentication appliance, has an improper privilege management flaw in versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. An attacker who already holds a valid account can raise their privileges beyond what they were granted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3 fixed 8.0.4
- vendor:FortiAuthenticator 6.6 affected >= 6.6.0, <= 6.6.10 fixed 6.6.11

## How to check

Check the FortiAuthenticator version (GUI dashboard or CLI 'get system status'). Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. Fortinet lists no workaround or virtual patch; the affected component is the GUI and the attacker must be authenticated.

## Fix

FortiAuthenticator 8.0: upgrade to 8.0.4 or above. FortiAuthenticator 6.6: upgrade to 6.6.11 or above.

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126249
- 2026-11-11T22:36:35+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-263 — Fortinet PSIRT FG-IR-26-263 read: fixed in 8.0.4 / 6.6.11, no workaround or virtual patch stated, not exploited per vendor. X/discussion not searched (no CVE-specific chatter expected).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-263: Improper privilege management (FortiAuthenticator) https://fortiguard.fortinet.com/psirt/FG-IR-26-263

## From the sources

A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_