CVE-2026-126257
CVSS Score
9.0
EPSS Score
0.0%
EPSS Percentile
0th
A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.
| CWE | CWE-259 |
| Vendor | fortinet |
| Product | fortiauthenticator |
| Ecosystems | |
| Industries | NetworkingSecurity |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for fortinet fortiauthenticator
Be the first to know when new critical vulnerabilities affecting fortinet fortiauthenticator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Fortinet / FortiAuthenticator
8.0.0 ≤ 8.0.3 6.6.0 ≤ 6.6.10