Fortinet FortiAuthenticator Vulnerable to Critical SQL Injection
Fortinet has disclosed a critical SQL injection vulnerability in its FortiAuthenticator collectoragent, potentially allowing authenticated attackers to execute unauthorized code.
Fortinet has issued a security advisory detailing a critical SQL injection vulnerability affecting multiple versions of its FortiAuthenticator product. The vulnerability, identified as FG-IR-26-266 and assigned CVE-2026-126252, carries a CVSSv3 score of 8.3, classifying it as high severity.
The flaw stems from improper neutralization of special elements used in SQL commands within the collectoragent component of FortiAuthenticator. This vulnerability, categorized under CWE-89, allows an authenticated attacker to inject malicious SQL queries into the system. By crafting specific HTTP requests, an attacker can exploit this weakness to execute arbitrary code or commands on the affected system.
The potential impact of this vulnerability is significant, threatening the integrity and confidentiality of the systems running the vulnerable FortiAuthenticator versions. Successful exploitation could lead to unauthorized data access, modification, or deletion, and could also serve as a pivot point for further network compromise.
Fortinet has listed a broad range of affected versions, spanning from FortiAuthenticator 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. The advisory indicates that the vulnerability was discovered internally by a member of the Fortinet Product Security team, with the assistance of an AI model named Claude Mythos.
While the advisory does not explicitly state whether the vulnerability is being actively exploited in the wild, its critical severity and the potential for code execution warrant immediate attention from organizations utilizing the affected FortiAuthenticator versions. The CVSSv3 score includes metrics indicating potential for exploitation (Exploit Code Maturity: Proof-of-concept, Remediation Level: Official Fix, Report Confidence: Confirmed).
Fortinet's advisory provides a list of specific product versions that are impacted by this vulnerability. Users are strongly advised to consult the advisory for the exact version numbers and to plan for an upgrade or apply any available patches as soon as possible to mitigate the risk. The advisory itself is available on the Fortinet PSIRT website.
This discovery underscores the ongoing challenges in securing complex enterprise software, particularly components that handle user input and interact with databases. The use of AI in vulnerability discovery, as noted by Fortinet, highlights the evolving landscape of cybersecurity research and threat detection.