---
id: "CVE-2026-126252"
page: "https://infrastack.ai/live/CVE-2026-126252"
kind: "vulnerability"
aliases: ["CVE-2026-126252"]
title: "Fortinet FortiAuthenticator: SQL injection lets a logged-in user run commands"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4"], "affected": ">= 8.0.0, <= 8.0.3", "ecosystem": "vendor"}, {"name": "FortiAuthenticator", "fixed": ["6.6.11"], "affected": ">= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["auth-required", "fortiauthenticator", "fortinet", "infrastructure", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "unauthenticated-only-access"]
published_at: "2026-11-11T22:17:25+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:35:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126252", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-266", "first_seen_at": "2026-11-11T22:35:46+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-266"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: SQL injection lets a logged-in user run commands

Link for people: https://infrastack.ai/live/CVE-2026-126252 (this .md is for agents)

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an SQL injection flaw reachable through HTTP requests. An authenticated attacker can execute unauthorized code or commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3 fixed 8.0.4
- vendor:FortiAuthenticator affected >= 6.6.0, <= 6.6.10 fixed 6.6.11

## How to check

Check the FortiAuthenticator version in the admin GUI (dashboard System Information) or CLI. Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. Fortinet lists no workaround or virtual patch.

## Fix

Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126252
- 2026-11-11T22:35:46+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-266 — Read Fortinet PSIRT FG-IR-26-266: fixed 8.0.4 / 6.6.11, authenticated, not exploited, no virtual patch. X and community search not done (no credits check run).

## Documents

- [advisory] FG-IR-26-266: SQL injection in FortiAuthenticator (CVE-2026-126252) https://fortiguard.fortinet.com/psirt/FG-IR-26-266

## From the sources

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_