Fortinet FortiAuthenticator Vulnerable to Resource Exhaustion Leading to DoS
Fortinet has disclosed a critical vulnerability in FortiAuthenticator that allows unauthenticated attackers to exhaust system resources, potentially causing a denial of service.
Fortinet has issued a security advisory detailing a critical vulnerability, identified as CWE-770, within its FortiAuthenticator product. This flaw, tracked under advisory FG-IR-26-258 and assigned CVE-2026-126244, permits unauthenticated attackers to exploit a weakness in resource allocation, leading to the exhaustion of system resources.
The vulnerability stems from an "Allocation of resources without limits or throttling" issue. In essence, the affected FortiAuthenticator instances do not properly manage or limit the resources that can be consumed by incoming requests. An unauthenticated attacker can leverage this by sending specially crafted requests that trigger excessive resource consumption, such as memory or CPU cycles, without any form of rate limiting or capacity control.
Successful exploitation of this vulnerability can result in a denial of service (DoS) condition. When system resources are fully exhausted, the FortiAuthenticator appliance will become unresponsive, rendering it unable to perform its intended functions. This could disrupt critical authentication and access control processes that rely on the FortiAuthenticator, potentially leading to widespread service outages for organizations using the product.
The severity of this vulnerability is underscored by its CVSSv3 score of 7.5, categorized as High. The attack vector is network-based (AV:N), requires no privileges (PR:N), and no user interaction (UI:N). The potential impact on availability is significant (A:H), while confidentiality and integrity remain unaffected (C:N, I:N).
Fortinet has identified a broad range of affected versions, including FortiAuthenticator 8.0.3 down to 8.0.0, and versions 6.6.10 down to 6.6.0. The company has released advisories and is urging customers to update their systems to patched versions to mitigate the risk. The advisory provides specific version information and links to download the necessary updates.
This vulnerability was discovered internally by Gwendal Guegniaud of the Fortinet Product Security team, with the assistance of the Claude Mythos AI model. The disclosure highlights the ongoing efforts by vendors to proactively identify and address security weaknesses, sometimes with the aid of advanced AI tools.
Organizations utilizing FortiAuthenticator are strongly advised to review the Fortinet advisory FG-IR-26-258 and apply the relevant security updates immediately. Failure to do so could leave their networks vulnerable to disruption and denial of service attacks, impacting business operations and security posture.