CVE-2026-44277: Fortinet FortiAuthenticator Auth Bypass

CVE-2026-44277 Overview

CVE-2026-44277 is an improper access control vulnerability [CWE-284] affecting multiple versions of Fortinet FortiAuthenticator. The flaw allows a remote, unauthenticated attacker to execute unauthorized code or commands over the network. FortiAuthenticator serves as an identity and access management appliance, providing two-factor authentication, RADIUS, LDAP, and certificate services for enterprise networks. A successful exploit grants attackers control over authentication infrastructure that protects downstream systems. Fortinet published advisory FG-IR-26-128 describing the affected versions and patch guidance.

Critical Impact
Remote attackers can execute unauthorized code or commands on FortiAuthenticator appliances without authentication, compromising the identity provider that protects connected enterprise resources.

Affected Products

Fortinet FortiAuthenticator 8.0.0 and 8.0.2
Fortinet FortiAuthenticator 6.6.0 through 6.6.8
Fortinet FortiAuthenticator 6.5.0 through 6.5.6

Discovery Timeline

2026-05-12 - CVE-2026-44277 published to the National Vulnerability Database
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-44277

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. FortiAuthenticator fails to enforce access restrictions on a network-reachable interface, permitting unauthenticated callers to invoke functionality that should be restricted to privileged users. The result is unauthorized code or command execution within the appliance.

FortiAuthenticator operates as a centralized identity provider. Compromise of this component allows attackers to manipulate authentication decisions, harvest credentials, issue certificates, or pivot into downstream systems that trust the appliance. The attack does not require user interaction or prior credentials.

Fortinet's advisory FG-IR-26-128 lists fixed builds for the 6.5, 6.6, and 8.0 trains. Administrators should consult the advisory to map their current build to the corresponding fixed release.

Root Cause

The root cause is missing or insufficient authorization checks on an exposed code path. The component evaluates a request and proceeds to a sensitive operation without verifying that the caller is authenticated or authorized. Fortinet has not publicly disclosed the specific endpoint or function involved.

Attack Vector

The attack vector is network-based. Any host that can reach the FortiAuthenticator management or service interface can attempt exploitation. No credentials, user interaction, or local access are required. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.047%.

No verified exploitation code is publicly available. See the Fortinet Security Advisory FG-IR-26-128 for technical details and fixed versions.

Detection Methods for CVE-2026-44277

Indicators of Compromise

Unexpected administrative actions, new user accounts, or modified authentication policies on FortiAuthenticator appliances
Outbound connections from FortiAuthenticator to unknown external hosts, indicating possible reverse shell activity
Anomalous certificate issuance, RADIUS configuration changes, or LDAP bind activity not tied to scheduled administration
HTTP/HTTPS requests to FortiAuthenticator management endpoints from untrusted source addresses

Detection Strategies

Inventory FortiAuthenticator deployments and compare running versions against the fixed builds listed in FG-IR-26-128
Review web server and audit logs on the appliance for unauthenticated requests to sensitive API paths
Correlate identity events with downstream authentication anomalies in SIEM platforms to surface lateral movement originating from a compromised identity provider
Monitor for shell or process execution events on the appliance that deviate from baseline administrative activity

Monitoring Recommendations

Forward FortiAuthenticator system, HTTPd, and admin audit logs to a centralized log platform with retention sufficient for incident response
Alert on configuration changes, administrator account creation, and certificate signing operations outside of approved change windows
Establish network flow monitoring for the management subnet hosting FortiAuthenticator to detect unexpected source addresses or protocols

How to Mitigate CVE-2026-44277

Immediate Actions Required

Upgrade FortiAuthenticator to a fixed release per Fortinet advisory FG-IR-26-128
Restrict network access to FortiAuthenticator management and service interfaces to trusted administrative networks only
Audit recent administrator activity, user account changes, and certificate issuance events for signs of abuse
Rotate credentials, API tokens, and certificates managed by the appliance if compromise is suspected

Patch Information

Fortinet has released fixed builds for the 6.5, 6.6, and 8.0 release trains. Refer to the Fortinet Security Advisory FG-IR-26-128 for the specific fixed version corresponding to each affected branch. Apply the upgrade following Fortinet's documented procedure and verify the appliance version after reboot.

Workarounds

Place FortiAuthenticator behind a firewall that restricts inbound access to required source addresses and ports
Disable any unused network services and administrative interfaces exposed by the appliance
Require VPN or jump host access for administrative connections to reduce exposure of management endpoints

bash

# Example: restrict access to FortiAuthenticator management interface
# Replace with your administrative subnet and appliance IP
iptables -A INPUT -p tcp -d <fortiauth-ip> --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -d <fortiauth-ip> --dport 443 -j DROP