CVE-2026-44277

critical · 9.8

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.

9.8

CVSS

0.6%

EPSS (exploit prob.)

45th

EPSS percentile

2026-05-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-284

Affected products

Vendor	Product	Affected versions
fortinet	fortiauthenticator	>= 6.4.0, <= 6.4.10
fortinet	fortiauthenticator	>= 6.5.0, < 6.5.7
fortinet	fortiauthenticator	>= 6.6.0, < 6.6.9
fortinet	fortiauthenticator	>= 8.0.0, < 8.0.3

Check a specific version with /api/v1/cve/match.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-128

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-44277