CVE-2026-44277
Full vulnerability record from the local CVENow database.
Description
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-12 18:17:30.040000
Last modified
2026-10-26 18:10:00.173000
View original CVE JSON
{
"id": "CVE-2026-44277",
"sourceIdentifier": "[email protected]",
"published": "2026-05-12T18:17:30.040",
"lastModified": "2026-10-26T18:10:00.173",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests."
},
{
"lang": "es",
"value": "Una vulnerabilidad de control de acceso inadecuado en Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 a 6.6.8, FortiAuthenticator 6.5.0 a 6.5.6 puede permitir al atacante ejecutar código o comandos no autorizados mediante solicitudes manipuladas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiAuthenticator",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiauthenticator:6.4.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "8.0.2",
"status": "affected"
},
{
"version": "8.0.0",
"status": "affected"
},
{
"version": "6.6.0",
"lessThanOrEqual": "6.6.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.5.0",
"lessThanOrEqual": "6.5.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.4.0",
"lessThanOrEqual": "6.4.10",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-12T18:59:33.244531Z",
"id": "CVE-2026-44277",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.0",
"versionEndIncluding": "6.4.10",
"matchCriteriaId": "F1E4B7B9-33C6-4CB8-9409-F3C51858C7A1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.0",
"versionEndExcluding": "6.5.7",
"matchCriteriaId": "E863E244-F0A2-48B3-BD36-3F16B7DC1222"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.0",
"versionEndExcluding": "6.6.9",
"matchCriteriaId": "2C556C61-42F5-43DB-A5C6-1245600B7E86"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0.0",
"versionEndExcluding": "8.0.3",
"matchCriteriaId": "5B1588CB-FBA6-4610-B055-A8123B465531"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-128",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}