CVE-2026-126247

high

Description

A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-261

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123890

Details

Source: Mitre, NVD

Published: 2026-11-11

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00342