---
id: CVE-2026-44277
title: >-
  A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2,
  FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8,
  FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through
  6.4.10 may allow att…
summary: >-
  A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2,
  FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8,
  FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through
  6.4.10 may allow att…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-284
vendor: Fortinet
product: FortiAuthenticator
affected:
  - FortiAuthenticator 8.0.2
  - FortiAuthenticator 8.0.0
  - FortiAuthenticator >= 6.6.0 <= 6.6.8
  - FortiAuthenticator >= 6.5.0 <= 6.5.6
  - FortiAuthenticator >= 6.4.0 <= 6.4.10
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-05-12T18:59:33.244531Z'
exploitAvailable: true
published: '2026-05-12'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:16.719Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-44277'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-128'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-128'
tags:
  - cve.org
  - exploit-available
epss: 0.00551
epssPercentile: 0.46282
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/0xBlackash/CVE-2026-44277'
  checkedAt: '2026-11-07T18:15:28.649Z'
ingestedAt: '2026-11-06T15:54:03.964Z'
---

## Overview

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through 6.4.10 may allow attacker to execute unauthorized code or commands via crafted requests.

## Affected

- `FortiAuthenticator 8.0.2`
- `FortiAuthenticator 8.0.0`
- `FortiAuthenticator >= 6.6.0 <= 6.6.8`
- `FortiAuthenticator >= 6.5.0 <= 6.5.6`
- `FortiAuthenticator >= 6.4.0 <= 6.4.10`

## Remediation

Upgrade to FortiAuthenticator version 8.0.3 or above
Upgrade to FortiAuthenticator version 8.0.1 or above
Upgrade to FortiAuthenticator version 6.6.9 or above
Upgrade to FortiAuthenticator version 6.5.7 or above
Upgrade to FortiAuthenticator version 6.4.11 or above
Upgrade to FortiAuthenticator version 6.3.5 or above