9.1 CriticalCWE-284
CVE-2026-44277
Fortinet FortiAuthenticator vulnerability
FortinetFortiAuthenticator
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 41% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 13 May · 07:20 UTC | Security Affairs | Fortinet patches critical RCE flaws in FortiAuthenticator, FortiSandbox |
| Wed 13 May · 09:49 UTC | SecurityWeek | Fortinet and Ivanti patch 18 flaws, including three critical bugs |
| Mon 18 May · 12:12 UTC | The Hacker News | Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws |
- Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation FlawsThe Hacker News · mentions it in passing
- Fortinet and Ivanti patch 18 flaws, including three critical bugsSecurityWeek
- Fortinet patches critical RCE flaws in FortiAuthenticator, FortiSandboxSecurity Affairs · first in our coverage