CVE-2026-21743
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions
Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.003
26.1th percentile
Discovered by
Not disclosed
Published
Feb 10, 2026
Assigned by fortinet
Description
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.
Weakness: CWE-862
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiAuthenticator | Identity / IAM / MFA | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiAuthenticator
Vendor remediation
Upgrade to FortiAuthenticator version 8.0.0 or above Upgrade to FortiAuthenticator version 6.6.7 or above