FortiAuthenticator incorrect authorization allows authentication bypass (CVE-2026-126251)

What happened

Fortinet's FG-IR-26-265 advisory describes an incorrect authorization vulnerability (CWE-863) in FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. An attacker can trigger it over the network with no privileges and no user interaction. A successful exploit may allow the attacker to bypass authentication and gain unauthorised access to the system.

According to the CVSS vector, the impact is high for integrity and availability and none for confidentiality, so the primary risk is an attacker changing data or disrupting the service rather than reading stored secrets. Fortinet's advisory does not state active exploitation, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalogue. No public exploit disclosure is recorded.

Who is affected

The affected products are FortiAuthenticator 8.0.0 through 8.0.3 and FortiAuthenticator 6.6.0 through 6.6.10. These are the only version ranges listed for the CVE. FortiAuthenticator is typically deployed as an identity and access management appliance, so an authentication bypass has direct consequences for access to protected resources.

What to do now

1. Identify FortiAuthenticator instances running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10.
2. Check Fortinet's FG-IR-26-265 advisory; no fixed version or vendor workaround is currently listed.
3. Since no workaround has been published, reduce exposure: make management and authentication endpoints reachable only from trusted networks, place them behind a VPN or firewall, and remove internet exposure where possible.
4. Review authentication and administrator logs for successful logins from unexpected sources, unexpected account changes, or configuration modifications.

How to detect it

Fortinet has not stated indicators of compromise for this issue. Treat affected FortiAuthenticator instances as exposed if they are reachable from untrusted networks. Review logs for successful authentication from unexpected addresses, newly created accounts, or unauthorised configuration changes.

Beyond the patch

An authentication bypass in the product that decides who is allowed in is a serious trust problem, and the absence of a listed fix makes network exposure the immediate risk. Virtual CISO Services (vCISO) can help locate and assess exposed FortiAuthenticator instances, while Managed Detection & Response (MDR) can watch for the credential abuse and configuration changes that follow from unauthorised access. Until Fortinet publishes a fix, Supply Chain Defense & Third-Party Risk is the right lens for tracking the vendor's patch cycle.