EUVD-2026-29729
GHSA-37fv-cfw9-w5r9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
Critical unauthenticated access control bypass in Fortinet FortiAuthenticator versions 6.5.0-6.5.6, 6.6.0-6.6.8, 8.0.0, and 8.0.2 enables remote code execution without authentication. The CVSS score of 9.8 with AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation against default configurations. While the vendor advisory (FG-IR-26-128) confirms this vulnerability, the incomplete description placeholder ('<insert attack vector here>') suggests the advisory may contain additional details not yet published in CVE records. No public exploit code or active exploitation confirmed at time of analysis, though the authentication bypass nature and maximum CVSS scores make this a priority patching target for organizations running FortiAuthenticator.
Technical ContextAI
FortiAuthenticator is Fortinet's centralized authentication, authorization, and accounting (AAA) solution providing multi-factor authentication, certificate management, and identity services for enterprise networks. The vulnerability is classified as CWE-284 (Improper Access Control), indicating flawed authorization logic that fails to properly enforce security policies. In authentication infrastructure products, improper access control often manifests as authentication bypass, privilege escalation, or unauthorized API access. The affected CPE string (cpe:2.3:a:fortinet:fortiauthenticator) encompasses multiple major versions (6.5.x, 6.6.x, 8.0.x), suggesting the flaw exists in core authentication or authorization logic shared across these release branches rather than a version-specific regression.
RemediationAI
Immediately upgrade FortiAuthenticator to patched versions specified in Fortinet advisory FG-IR-26-128 at https://fortiguard.fortinet.com/psirt/FG-IR-26-128 (specific fixed versions not provided in CVE data - consult vendor advisory directly). Until patching is completed, implement network-level compensating controls: restrict FortiAuthenticator management interfaces to trusted administrator IP addresses via firewall rules, disable internet-facing exposure if not operationally required, enable extensive authentication logging and monitoring for anomalous access patterns, and consider placing FortiAuthenticator behind a web application firewall with strict allow-listing if remote access is necessary. Note these mitigations do not eliminate the vulnerability and may impact legitimate remote administration workflows - they only reduce attack surface while patching is prioritized. Given the authentication bypass nature, compensating controls should be considered temporary risk reduction only.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today