{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126242", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-11-10T20:09:40.669Z", "datePublished": "2026-11-11T21:31:20.079Z", "dateUpdated": "2026-11-12T19:06:19.910Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiAuthenticator", "cpes": ["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "8.0.0", "lessThanOrEqual": "8.0.3", "status": "affected"}, {"versionType": "semver", "version": "6.6.0", "lessThanOrEqual": "6.6.10", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-11T21:31:20.079Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "Improper access control", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above\nUpgrade to upcoming FortiAuthenticator version 6.5.8 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T15:59:18.642880Z", "id": "CVE-2026-126242", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T19:06:19.910Z"}}]}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiAuthenticator", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "8.0.3", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.10", "status": "affected", "version": "6.6.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}], "id": "CVE-2026-126242", "lastModified": "2026-11-12T19:17:01.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "psirt@fortinet.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126242", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T15:59:18.642880Z", "version": "2.0.3"}}]}, "published": "2026-11-11T22:17:23.893", "references": [{"source": "psirt@fortinet.com", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"created": "2026-11-12T16:45:05.968632+00:00", "title": "FortiAuthenticator Authorization Bypass Allowing Unauthorized Access", "updated": "2026-11-12T16:45:05.968638+00:00", "vendors": []}