CVE-2026-126257

critical

Description

A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-271

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123899

Details

Source: Mitre, NVD

Published: 2026-11-11

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00395