Fortinet says someone without an account could get past the sign-in check in some cases. They could then gain access without permission.Fortinet gives the flaw a Critical CVSS 3.1 score of 9.0. It published advisory FG-IR-26-271 on November 10, 2026.
What it allows
How Can CVE-2026-126257 Affect FortiAuthenticator?
Fortinet lists privilege escalation as the impact. Its CVSS 3.1 score reflects high attack complexity and no privileges required.
Keep access to the device within the rules you set. List the builds in use so you can check which devices received the fix.
Use the network segmentation glossary to help set rules for which devices can reach each other. The Fortinet release overview lists fixes for other Fortinet products.
Is CVE-2026-126257 Known to Be Exploited?
Fortinet marked this flaw Known Exploited: No when it published FG-IR-26-271. CISA KEV catalog version 2026.11.10 did not list the CVE.
Both sources can change. Check for updates as you plan the fix.
Who is affected
Which Versions Are Affected by CVE-2026-126257?
Fortinet lists affected builds in the 8.0 and 6.6 lines. Check the table before you set a time for the fix.
| Release line | Affected builds | Fortinet solution |
|---|---|---|
| FortiAuthenticator 8.0 | 8.0.0 through 8.0.3 | Upgrade to 8.0.4 or above |
| FortiAuthenticator 6.6 | 6.6.0 through 6.6.10 | Upgrade to 6.6.11 or above |
Fortinet calls for an upgrade on both lines. Check the build once the fix is in place. Test the sign-in paths that your teams use.
The vulnerability management guide shows how to plan and track fixes. Read Fortinet’s latest advice before you start.
Timeline
- 2026-11-10
Fortinet published FG-IR-26-271 and marked Known Exploited as No.
- 2026-11-11
The Fortinet CVE record and NVD record for CVE-2026-126257 were published.
What to do
-
Find affected appliances
List each device and its build. Use the table to choose the fix for the line it runs.
-
Plan the upgrade
Check the upgrade path for each device. Include the backup units if you run a pair.
-
Check the fix
Confirm the new build. Test normal sign-ins. Review the access logs for any change you did not expect.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-126257?
It is a hard-coded password vulnerability in FortiAuthenticator. Fortinet says an attacker could get past the sign-in check in some cases.
What prerequisites does Fortinet score?
Fortinet scores the flaw as high complexity, with a network attack vector and no privileges required.
Which builds contain the Fortinet fix?
The first fixed builds are 8.0.4 and 6.6.11. Fortinet says to install those builds or later builds on the same release lines.
Is CVE-2026-126257 listed in CISA KEV?
CISA’s 2026.11.10 KEV catalog did not list the CVE. Fortinet marked it Known Exploited: No when it published the advisory.
Sources
- FG-IR-26-271: Authentication bypassFortinet PSIRT
- CVE-2026-126257 CVE recordFortinet CVE Numbering Authority
- CVE-2026-126257 NVD recordNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
