FortiAuthenticator SQL injection scores CVSS 8.8
Original title: Improper neutralization of special elements used in an SQL command
An authenticated attacker can run unauthorized SQL commands on the underlying database.
Fortinet PSIRT reports an SQL injection vulnerability in FortiAuthenticator, tracked as FG-IR-26-256 and scored CVSSv3 8.8. An authenticated attacker may execute unauthorized SQL commands on the underlying database. The advisory was revised on November 10, 2026. The snippet does not name affected versions, a fixed release, a CVE id or exploitation status.
Unconfirmed: Versions, a fix, a CVE id and exploitation status are not stated in the snippet.
- CVSSv3 score is 8.8; the weakness is CWE-89.
- Impact is unauthorized SQL on the underlying database.
- The attacker must already be authenticated.
- The advisory was revised on November 10, 2026.
Impact: Authenticated unauthorized SQL commands on the database
| Product | Affected |
|---|---|
| Fortinet FortiAuthenticator | — |
- Vendors
- Fortinet
- Products
- FortiAuthenticator
From the original article
CVSSv3 Score: 8. 8 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')[CWE-89] in FortiAuthenticator may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.