Hoch 8.2Software
CVE-2026-126240
Fortinet Produkte: Mehrere Schwachstellen
Fortinet FortiAuthenticator, Fortinet FortiAnalyzer, Fortinet FortiManager, Fortinet FortiOS, Fortinet FortiMail
A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).
11. Nov 2026
Original bei CERT-Bund öffnen