home / blog
2026-05-12 · critical
FortiAuthenticator: improper access control (CVE-2026-44277)
Improper access control in FortiAuthenticator 8.0 and 6.x versions, with unauthorised command execution, CVSS 9.8.
On 12 May 2026 the record for CVE-2026-44277 was published, an improper access control issue in Fortinet FortiAuthenticator. According to NVD, specially crafted requests allow an attacker to run unauthorised commands or code. The CVSS v3.1 score is 9.8. Affected versions include 8.0.0 and 8.0.2, plus the 6.6.x and 6.5.x series.
FortiAuthenticator manages identity and authentication for other services. A compromise of the server can therefore have knock-on effects on applications, VPNs and access that rely on it as an authentication source.
Apply the fix described in advisory FG-IR-26-128, checking the installed version. Review administrative logs and changes to accounts and configurations since the server was exposed.
At a glance
- What
- Improper access control in FortiAuthenticator. Specially crafted requests allow unauthorised code or command execution.
- Severity
- CVSS v3.1 9.8 (critical), according to NVD.
- Affected versions
- FortiAuthenticator 8.0.0 and 8.0.2, and the 6.6.x and 6.5.x versions listed in the advisory.
- Cause
- Improper access control (CWE-284).
- Action
- Apply the fix in advisory FG-IR-26-128. FortiAuthenticator handles authentication: a compromise can extend to systems that depend on it.
Sources: NVD, CVE-2026-44277 · Fortinet PSIRT, FG-IR-26-128