FORTIAUTHENTICATOR · CVE-2026-126252 · Infrastructure
FIX → 8.0.4 · 6.6.11 ✓ verified
FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an SQL injection flaw reachable through HTTP requests. An authenticated attacker can execute unauthorized code or commands on the appliance.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any self-hosted FortiAuthenticator appliance or VM running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. An attacker needs a valid login, then can send crafted HTTP requests to the API to run unauthorized code or commands. Fortinet's advisory lists only FortiAuthenticator 8.0 and 6.6 as affected; teams without FortiAuthenticator, or on 8.0.4 / 6.6.11 and later, can skip it.
Not affected if auth-required, unauthenticated-only-access
Who cares auth-required, fortiauthenticator, fortinet, self-hosted, sql-injection
8.0.0 through 8.0.3 or through A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
6.6.06.6.10Upgrade to 8.0.4 · 6.6.11
Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above