{"id":"CVE-2026-44277","aliases":["EUVD-2026-29729","GHSA-37fv-cfw9-w5r9"],"status":"published","title":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator...","description":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through 6.4.10 may allow attacker to execute unauthorized code or commands via crafted requests.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00551,"percentile":0.46503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-284"],"published":"2026-05-12T16:54:05Z","modified":"2026-11-06T16:18:44Z","exploits":[{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-44277","title":"ashrafzaryouh/CVE-2026-44277","date":"2026-05-13","url":"https://github.com/ashrafzaryouh/CVE-2026-44277"}],"products":[{"vendor":"fortinet","product":"fortiauthenticator"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-128","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44277"},{"url":"https://github.com/advisories/GHSA-37fv-cfw9-w5r9"}],"sources":{"cve":[{"id":"CVE-2026-44277","description":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through 6.4.10 may allow attacker to execute unauthorized code or commands via crafted requests.","status":"published","published":"2026-05-12T16:54:05.024Z","modified":"2026-11-06T15:42:16.719Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T16:58:46.729138Z"}],"euvd":[{"id":"EUVD-2026-29729","description":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through 6.4.10 may allow attacker to execute unauthorized code or commands via crafted requests.","status":"published","published":"2026-05-12T16:54:05Z","modified":"2026-11-06T15:42:16Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","level":"critical"}],"updated_at":"2026-11-06T17:05:30.233809Z"}],"ghsa":[{"id":"GHSA-37fv-cfw9-w5r9","title":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator...","description":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via \u003cinsert attack vector here\u003e","status":"published","published":"2026-05-12T18:30:47Z","modified":"2026-05-12T18:30:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:08:05.647564Z"}],"nvd":[{"id":"CVE-2026-44277","description":"A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through 6.4.10 may allow attacker to execute unauthorized code or commands via crafted requests.","status":"published","published":"2026-05-12T18:17:30.04Z","modified":"2026-11-06T16:18:44.903Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T18:00:52.116018Z"}]}}