CVE-2026-121526 is an open redirect vulnerability in Fortinet FortiAuthenticator versions 6.5.0 through 6.5.7, 6.6.0 through 6.6.10, and 8.0.0 through 8.0.3. This flaw allows an unauthenticated attacker to redirect users to untrusted external sites via crafted HTTP requests. The vulnerability has a medium severity rating with a CVSS score of 5.8. An official fix is available from Fortinet.
CVE-2026-126253 is a critical authentication bypass vulnerability in Fortinet FortiOS versions 7.0.1 through 8.0.1. It allows an unauthenticated attacker to broadcast Link State Advertisements (LSA) via specially crafted requests, potentially impacting system integrity and availability. The vulnerability affects multiple FortiOS release lines and has an official fix available.
CVE-2026-126252 is a high-severity SQL injection vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests. The vulnerability has been officially fixed by Fortinet.
CVE-2026-126251 is a critical escalation of privilege vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. The flaw involves incorrect authorization that may allow an attacker to bypass authentication and gain unauthorized access to the system. A patch is available and an official fix has been released by Fortinet.
CVE-2026-126250 is a high-severity denial of service vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It arises from incorrect authorization handling that allows an unauthenticated attacker to cause service disruption via crafted HTTP requests. An official fix is available to address this issue.
CVE-2026-126248 is an information disclosure vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It allows an unauthenticated attacker to obtain sensitive information via HTTPS requests due to insufficient protection of credentials. The vulnerability has a high severity score of 7.5 and has been officially fixed by Fortinet.
CVE-2026-126246 is a denial of service vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It is caused by a null pointer dereference that can be triggered by unauthenticated HTTP requests. This flaw allows attackers to disrupt service availability without requiring authentication.
CVE-2026-126249 is a high-severity vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It involves improper privilege management that could allow an authenticated attacker to escalate their privileges. An official fix is available for this issue.
CVE-2026-126247 is a vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It involves an externally-controlled format string flaw that allows an authenticated privileged attacker to execute unauthorized code or commands via HTTP requests. The vulnerability has a high severity with a CVSS score of 7.2. An official fix is available for this issue.
CVE-2026-126245 is an out-of-bounds write vulnerability affecting Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This flaw may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests if they can bypass ASLR protections. The vulnerability has a high severity rating with a CVSS score of 8.1. An official fix is available from Fortinet.
CVE-2026-126244 is a high-severity denial of service vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It involves allocation of resources without limits or throttling, which may allow an unauthenticated attacker to exhaust system resources and cause a denial of service condition.
CVE-2026-126236 is an OS command injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. This flaw allows an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests. The vulnerability impacts FortiManager versions 7.2.0 through 8.0.1 and FortiAnalyzer versions 7.2.0 through 8.0.1, among others. A fix is officially available from the vendor.
CVE-2026-126241 is a SQL injection vulnerability in Fortinet FortiAuthenticator versions 6.5.2 through 6.5.7, 6.6.0 through 6.6.10, and 8.0.0 through 8.0.3. This flaw allows an authenticated attacker to execute unauthorized SQL commands on the underlying database, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 and has been officially fixed by Fortinet.
CVE-2026-126239 is a stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This flaw may allow an unauthenticated attacker to crash the FSSO subsystem by sending specially crafted HTTP requests. The vulnerability has a high severity rating with a CVSS score of 7.5. An official fix is available to address this issue.
CVE-2026-126214 is a high-severity authentication bypass vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products. It allows an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted GUI requests. The vulnerability impacts FortiManager versions 7.2.0 through 8.0.1 and FortiAnalyzer versions 7.2.0 through 8.0.1, including cloud variants. An official fix is available to address this issue.
CVE-2026-126224 is a high-severity vulnerability in Fortinet FortiManager and FortiAnalyzer products that allows an authenticated privileged administrator to execute unauthorized code or commands due to improper neutralization of argument delimiters (argument injection). This affects multiple versions of FortiManager and FortiAnalyzer, including cloud variants. An official fix is available.
CVE-2026-126216 is an improper privilege management vulnerability in Fortinet FortiManager and FortiManager Cloud versions 7.2.0 through 8.0.1. It allows an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted GUI requests. The vulnerability has a low severity score and does not impact confidentiality or availability significantly. An official fix is available from the vendor.
CVE-2026-126228 is an out-of-bounds write vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated remote attacker with administrative privileges to execute unauthorized code or commands by sending a specially crafted request. The vulnerability impacts versions ranging from 7.2.4 through 8.0.1 across these products. A fix is officially available to address this issue.
CVE-2026-126215 is an authorization vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. It allows an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted GUI requests. The vulnerability affects versions 7.2.0 through 8.0.1 across several release lines. A fix is available from the vendor.
CVE-2026-126240 is an LDAP injection vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It allows an authenticated attacker to bypass authentication if the upstream Identity Provider (IdP) is malicious or compromised, or if the IdP configuration allows user control over the NameID or SAML attribute used as the username. The vulnerability has a high severity score of 8.2 and has been officially fixed by Fortinet.