FortiAuthenticator hard-coded password allows unauthenticated authentication bypass (CVE-2026-126257)

What happened

Fortinet's advisory describes a hard-coded password in FortiAuthenticator. An unauthenticated attacker who can reach the affected service over the network can use this password to bypass credential validation in certain circumstances outside the attacker's control. If the bypass succeeds, the attacker gains unauthorised access without valid credentials. The vulnerability is classed as CWE-259, use of a hard-coded password.

CVSS 3.1 rates the issue 9.0 critical. The vector describes a network-based attack with high attack complexity, no privileges or user interaction required, and high confidentiality, integrity and availability impact across a changed scope.

Fortinet has not recorded active exploitation, and the CVE record does not list public disclosure of exploit code.

Who is affected

Affected versions are Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. Fortinet's advisory names these ranges and no others. If you run one of these versions, the vulnerability applies to your deployment. No fixed release is listed for either range.

What to do now

1. Identify FortiAuthenticator instances and check versions against 8.0.0–8.0.3 and 6.6.0–6.6.10.
2. No fixed release is listed yet and Fortinet has not published a workaround. Treat access restriction and monitoring as your primary containment measures.
3. Restrict network reachability of affected FortiAuthenticator appliances to trusted management and authentication clients only. Remove any internet-facing or untrusted network exposure.
4. Review authentication and administrative activity for unexpected or unauthorised access, and investigate anything that cannot be tied to expected users or maintenance windows.
5. Monitor Fortinet advisory FG-IR-26-271 for fixed versions and apply them after normal testing once they are available.

Beyond the patch

This is a critical, network-reachable authentication bypass with no vendor fix or workaround, so the practical exposure window is yours to manage. Knowing where every FortiAuthenticator is reachable and what it protects is the immediate priority — our Virtual CISO Services (vCISO) helps with that exposure view and containment planning. Because successful abuse would create unauthorised authentication or administrative activity, Managed Detection & Response (MDR) can monitor for that trail while you wait for Fortinet to publish a fix.