Fortinet says a person without an account could get access without signing in. The advisory lists privilege escalation as the impact.Fortinet gives the flaw a Critical CVSS 3.1 score of 9.1. It published advisory FG-IR-26-265 on November 10, 2026.
What it allows
What Access Can CVE-2026-126251 Affect?
The flaw is in the API. Fortinet’s CVSS 3.1 score is based on a network attack vector. It lists no privileges required.
Check which networks can reach the device while you plan the fix. Limit access to the users and systems that need it.
The least privilege glossary shows how to limit access. The Fortinet security updates overview lists fixes for other Fortinet products.
Is CVE-2026-126251 Known to Be Exploited?
Fortinet marked this flaw Known Exploited: No when it published FG-IR-26-265. CISA KEV catalog version 2026.11.10 did not list the CVE.
Both sources can change. Check for updates as you plan the fix.
Who is affected
Which Versions Are Affected by CVE-2026-126251?
Fortinet lists two release lines. Check which build you run. Follow Fortinet’s upgrade path to the fixed build.
| Release line | Affected builds | Fortinet solution |
|---|---|---|
| FortiAuthenticator 8.0 | 8.0.0 through 8.0.3 | Upgrade to 8.0.4 or above |
| FortiAuthenticator 6.6 | 6.6.0 through 6.6.10 | Upgrade to 6.6.11 or above |
Set a time with the teams that use the service. After the upgrade, check that users can still sign in and that admins have the right access.
The vulnerability management guide shows how to plan and track fixes. Read Fortinet’s latest advice before you start.
Timeline
- 2026-11-10
Fortinet published FG-IR-26-265 and marked Known Exploited as No.
- 2026-11-11
The Fortinet CVE record and NVD record for CVE-2026-126251 were published.
What to do
-
Find affected appliances
List each device and its build. Use the table to choose the fix for the line it runs.
-
Review API access
Check which apps and hosts can reach the API. Look for admin actions that do not match your records.
-
Check the fix
Confirm the new build. Test the sign-in paths and API calls that your teams use.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-126251?
It is an incorrect authorization flaw in the FortiAuthenticator API. Fortinet says an attacker could get in without signing in.
Does an attacker need an account?
Fortinet’s CVSS 3.1 score gives the flaw a network attack vector. It lists no privileges required.
Which FortiAuthenticator releases fix CVE-2026-126251?
The first fixed builds are 8.0.4 and 6.6.11. Fortinet says to install those builds or later builds on the same release lines.
Is CVE-2026-126251 listed in CISA KEV?
CISA’s 2026.11.10 KEV catalog did not list the CVE. Fortinet marked it Known Exploited: No when it published the advisory.
Sources
- FG-IR-26-265: Incorrect authorizationFortinet PSIRT
- CVE-2026-126251 CVE recordFortinet CVE Numbering Authority
- CVE-2026-126251 NVD recordNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
