CVE-2026-44277

—

CVSS 3.1

9.8 critical

EPSS

<1%p44

Published

May 12, 2026 (May 12, 2026)

Modified

Jun 17, 2026

Description

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.

Vendors: fortinet
Products: fortiauthenticator
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news2 stories

Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws

The Hacker NewsMay 18, 17:02 UTC · May 18, 2026Vulnerability CVE-2026-8043 CVE-2026-44277 CVE-2026-26083+8 CVEs1

Critical fortinet vulnerabilities fixed in FortiSandbox and FortiAuthenticator

Security AffairsMay 13, 06:23 UTC · May 13, 2026Vulnerability in the wildCVE-2026-44277 CVE-2026-26083