{"id":"CVE-2026-126252","kind":"vulnerability","aliases":["CVE-2026-126252"],"related":[],"title":"Fortinet FortiAuthenticator: SQL injection lets a logged-in user run commands","description":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an SQL injection flaw reachable through HTTP requests. An authenticated attacker can execute unauthorized code or commands on the appliance.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4"],"affected":">= 8.0.0, <= 8.0.3","ecosystem":"vendor"},{"name":"FortiAuthenticator","fixed":["6.6.11"],"affected":">= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["auth-required","fortiauthenticator","fortinet","infrastructure","self-hosted","sql-injection"],"not_affected_if":["auth-required","unauthenticated-only-access"],"how_to_check":"Check the FortiAuthenticator version in the admin GUI (dashboard System Information) or CLI. Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. Fortinet lists no workaround or virtual patch.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above","status":"open","published_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:36+00:00","updated_at":"2026-11-11T22:35:46+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:31:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAuthenticator: SQL injection lets a logged-in user run commands","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an SQL injection flaw reachable through HTTP requests. An authenticated attacker can execute unauthorized code or commands on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker executes unauthorized code or commands on the appliance","analyst_note":"Confirm the fixed versions and any vendor advisory for CVE-2026-126252 at the Fortinet PSIRT site; the sources here give no fix.","how_to_check":"- Check the installed FortiAuthenticator version in the admin GUI or with the vendor's version command, and compare it with the affected ranges `8.0.0`–`8.0.3` and `6.6.0`–`6.6.10`\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"FortiAuthenticator","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are exposed. The attacker needs an authenticated account, so exposure depends on who can log in to the appliance's HTTP interface. Systems outside those version ranges are not affected according to the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4561,"output_tokens":642,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any vendor advisory for CVE-2026-126252 at the Fortinet PSIRT site; the sources here give no fix.","search":"'-126252':15A,18A '-2026':14A,17A '6.6.0':38B,83C '6.6.10':40B,85C '8.0.0':34B,79C '8.0.3':36B,81C 'allow':87C 'applianc':61B 'attack':52B,90C 'auth':22B 'auth-requir':21B 'authent':51B,89C 'code':56B,94C 'command':12A,58B,72C,96C 'contain':41B 'cve':13A,16A 'element':67C 'execut':54B,92C 'flaw':45B 'fortiauthent':2A,24B,33B,78C,82C 'fortiauthenticator':19A,20A 'fortinet':1A,25B,77C 'host':29B 'http':48B,98C 'improp':63C 'infrastructur':26B 'inject':4A,32B,44B,74C 'let':5A 'log':8A 'logged-in':7A 'may':86C 'neutral':64C 'reachabl':46B 'request':49B,99C 'requir':23B 'run':11A 'self':28B 'self-host':27B 'special':66C 'sql':3A,31B,43B,71C,73C 'sql-inject':30B 'unauthor':55B,93C 'use':68C 'user':10A 'via':97C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted FortiAuthenticator appliance or VM running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. An attacker needs a valid login, then can send crafted HTTP requests to the API to run unauthorized code or commands. Fortinet's advisory lists only FortiAuthenticator 8.0 and 6.6 as affected; teams without FortiAuthenticator, or on 8.0.4 / 6.6.11 and later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:35:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266","run_id":3617},"products":{"at":"2026-11-11T22:35:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266","run_id":3617},"how_to_check":{"at":"2026-11-11T22:35:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266","run_id":3617},"who_affected":{"at":"2026-11-11T22:35:46Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266","run_id":3617}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["authrequired","fortiauthenticator","fortinet","high","infrastructure","selfhosted","sqlinjection","vendor"],"campaign_type":null,"search_a":"'-126252':15A,18A '-2026':14A,17A 'command':12A 'cve':13A,16A 'fortiauthent':2A 'fortiauthenticator':19A,20A 'fortinet':1A 'inject':4A 'let':5A 'log':8A 'logged-in':7A 'run':11A 'sql':3A 'user':10A","search_b":"'6.6.0':38B '6.6.10':40B '8.0.0':34B '8.0.3':36B 'applianc':61B 'attack':52B 'auth':22B 'auth-requir':21B 'authent':51B 'code':56B 'command':58B 'contain':41B 'execut':54B 'flaw':45B 'fortiauthent':24B,33B 'fortinet':25B 'host':29B 'http':48B 'infrastructur':26B 'inject':32B,44B 'reachabl':46B 'request':49B 'requir':23B 'self':28B 'self-host':27B 'sql':31B,43B 'sql-inject':30B 'unauthor':55B","search_c":"'6.6.0':83C '6.6.10':85C '8.0.0':79C '8.0.3':81C 'allow':87C 'attack':90C 'authent':89C 'code':94C 'command':72C,96C 'element':67C 'execut':92C 'fortiauthent':78C,82C 'fortinet':77C 'http':98C 'improp':63C 'inject':74C 'may':86C 'neutral':64C 'request':99C 'special':66C 'sql':71C,73C 'unauthor':93C 'use':68C 'via':97C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126252","severity":null,"published_at":"2026-11-11T22:17:25+00:00","modified_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126252:3617","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266","severity":null,"published_at":"2026-11-11T22:35:46+00:00","modified_at":"2026-11-11T22:35:46+00:00","first_seen_at":"2026-11-11T22:35:46+00:00","fetched_at":"2026-11-11T22:35:46+00:00","note":"Read Fortinet PSIRT FG-IR-26-266: fixed 8.0.4 / 6.6.11, authenticated, not exploited, no virtual patch. X and community search not done (no credits check run).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-266"]}],"documents":[{"id":129660,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266","title":"FG-IR-26-266: SQL injection in FortiAuthenticator (CVE-2026-126252)","kind":"advisory","source":"analyst","publisher":null,"text":"FortiAuthenticator 8.0.0 through 8.0.3: upgrade to 8.0.4 or above. 6.6.0 through 6.6.10: upgrade to 6.6.11 or above. Authenticated attacker, HTTP requests, component API, CVSSv3 8.3 High, Known Exploited: No, Virtual Patch: No. Published Nov 10, 2026. Internally discovered by Fortinet Product Security using Claude Mythos.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}