If FortiAuthenticator is a trust point for VPN, admin or federated logins, verify the appliance build and what its upstream identity provider can assert.
Fortinet published these advisories November 10, 2026. Its reviewed advisories mark known exploitation as No, and CISA KEV did not list these CVEs at verification November 10, 2026. Scores below are Fortinet’s CVSS 3.1 values.
What Fortinet disclosed
FG-IR-26-265 / CVE-2026-126251 is Critical 9.1 and can bypass authentication. FG-IR-26-271 / CVE-2026-126257 is Critical 9.0 and can bypass credential validation under conditions outside the attacker’s control. Fortinet does not further specify those conditions in the public advisory. Both are marked unauthenticated.
FG-IR-26-255 / CVE-2026-126240 is High 8.2. Its authenticated path requires a compromised or malicious upstream identity provider, or an identity-provider configuration that lets users control the NameID or the SAML attribute used as the username. FG-IR-26-258 / CVE-2026-126244 is High 7.5 and can exhaust resources without authentication.
Affected versions and fixes
All four list FortiAuthenticator 8.0.0–8.0.3 → 8.0.4+ and 6.6.0–6.6.10 → 6.6.11+. Fortinet lists no virtual patch for these four and publishes no blanket rotation direction.
Suggested MSP priority · expedited for identity infrastructure
Inventory appliances, accessible interfaces, upstream identity providers and dependent services. Limit exposed access where safe and review whether users can alter username-mapping attributes. Roll out the fixed build and test SAML mapping, MFA, RADIUS and dependent sign-ins. Preserve evidence and investigate unusual authentication or identity changes if present.
Official sources
FG-IR-26-265 · FG-IR-26-271 · FG-IR-26-255 · FG-IR-26-258 · Fortinet upgrade path tool · CISA KEV data