CVE-2026-44277: critical vulnerability in Fortinet FortiAuthenticator
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has an official Brazilian government alert and has a public proof of concept.
ssvc Attendcvss 9.1epss 0.6%
from disclosure to weapon1 day
Published on NVDMay 12
1st PoC+1d
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CISC Gov.br · 22 May 2026CVE-2026-44277 — Controle de Acesso Inadequado no Fortinet FortiAuthenticatorread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Affected products
Fortinet · FortiAuthenticatorpublic PoCs found — 1
githubgithub.com/0xBlackash/CVE-2026-44277★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Fortinet FortiAuthenticator
In the same product, most dangerous first.