CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Fortinet FortiAuthenticator

product · product:fortinet-fortiauthenticator

Coverage
1
first 2026-05-13 → last 2026-10-21
Latest activity
2026-05-13
Fortinet fixes unauthenticated code execution in the FortiAuthenticator API and the FortiSandbox web UI
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
6
4 hosts

Defender insights

What each entry about Fortinet FortiAuthenticator tells a defender to do, newest first.

2026-05-13HIGHFortinet fixes unauthenticated code execution in the FortiAuthenticator API and the FortiSandbox web UI

Exposure · detection

Story timeline

  1. 2026-05-13CVE-2026-44277 and CVE-2026-26083: unauthenticated code execution in the Fortinet FortiAuthenticator API and the FortiSandbox web UI
    trending-vulnerabilitiesFortinet fixes unauthenticated code execution in the FortiAuthenticator API and the FortiSandbox web UI

Hunting pivots

CVEs
CVE-2026-26083CVE-2026-44277
Releases covered
Fortinet FortiAuthenticator
Tags
identitypatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-13/cve-2026-44277-cve-2026-26083-fortinet-fortiauthenticator-an · ATT&CK page ↗

Entries about Fortinet FortiAuthenticator (1)

2026-05-13 · view entry permalink →

HIGHCVE-2026-44277 +1updatedNATOA2

CVE-2026-44277 and CVE-2026-26083: unauthenticated code execution in the Fortinet FortiAuthenticator API and the FortiSandbox web UI

CVE-2026-44277 is an improper access control flaw (CWE-284) on FortiAuthenticator's API endpoints that may let an unauthenticated attacker execute unauthorized code or commands through crafted requests; it affects FortiAuthenticator 6.5.0 to 6.5.6, 6.6.0 to 6.6.8, 8.0.0 and 8.0.2, is fixed in 6.5.7, 6.6.9 and 8.0.3, does not affect FortiAuthenticator Cloud, and can be worked around by disabling API access on exposed interfaces under Network, Interfaces, Access Rights (Fortinet FG-IR-26-128). CVE-2026-26083 is a missing authorization flaw (CWE-862) in the web UI of FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS with the same effect through HTTP requests; FortiSandbox is fixed in 4.4.9 and 5.0.2, FortiSandbox Cloud 5.0 in 5.0.6 and FortiSandbox PaaS 4.4 and 5.0 in 4.4.9 and 5.0.2, while FortiSandbox Cloud 23 and 24 and PaaS 21.3 to 23.4 must migrate to a fixed release (Fortinet FG-IR-26-136). Fortinet discovered both internally, rates each Critical with a CVSSv3 base score of 9.8 and a temporal score of 9.1, and marked neither as known exploited when it published on 2026-05-12 (Fortinet FG-IR-26-128; Fortinet FG-IR-26-136). ENISA's EUVD records carry the 9.1 figure and also list FortiAuthenticator 6.4.0 to 6.4.10 and FortiSandbox 4.2.1 to 4.2.8 as affected (EUVD-2026-29729; EUVD-2026-29550), branches for which Fortinet's advisories, as read on 2026-10-21, name no fixed release (Fortinet FG-IR-26-128; Fortinet FG-IR-26-136).

in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

FortiAuthenticator Cloud is not impacted by the issue and hence customers do not need to perform any action.

Fortinet PSIRT FG-IR-26-128 2026-05-12

in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Fortinet PSIRT FG-IR-26-136 2026-05-12
Improvementrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationcvesevidenceheadlinesourcessourcing_notesummarytechniquestitleevent_date

Fortinet rates both flaws at a CVSSv3 base score of 9.8 with a temporal score of 9.1 (Fortinet FG-IR-26-128; Fortinet FG-IR-26-136), and 9.1 is the figure ENISA's EUVD records carry (EUVD-2026-29729). The EUVD records also list FortiAuthenticator 6.4.0 to 6.4.10 and FortiSandbox 4.2.1 to 4.2.8 as affected (EUVD-2026-29550), branches for which Fortinet names no fixed release, and FortiSandbox Cloud 23 and 24 and PaaS 21.3 to 23.4 must migrate to a fixed release (Fortinet FG-IR-26-136). The mitigation Fortinet gives until FortiAuthenticator is upgraded is to disable API access on exposed interfaces under Network, Interfaces, Access Rights (Fortinet FG-IR-26-128).

vulnerability13 May 05:00Zmulti-sourceOpen finding →
Sources: Fortinet PSIRT FG-IR-26-128 · Fortinet PSIRT FG-IR-26-136 · NCSC-CH Security Hub #12569 · BleepingComputer · ENISA EUVD (EUVD-2026-29729, CVE-2026-44277) · ENISA EUVD (EUVD-2026-29550, CVE-2026-26083)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • euvd.enisa.europa.eu2 (33%)
  • fortiguard.fortinet.com2 (33%)
  • bleepingcomputer.com1 (17%)
  • security-hub.ncsc.admin.ch1 (17%)
All cited sources (6)