CVE-2026-126252

high

Description

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-266

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123896

Details

Source: Mitre, NVD

Published: 2026-11-11

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:P

Severity: High

CVSS v3

Base Score: 8.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Severity: High

EPSS

EPSS: 0.00352