Fortinet FortiAuthenticator: Unauthenticated remote code execution (CVE-2026-44277)

CVE-2026-44277 is a critical remote code execution vulnerability in Fortinet FortiAuthenticator. The flaw exists due to improper access control on specific API endpoints, which allows unauthenticated attackers to execute arbitrary code on the appliance. Proof-of-concept exploit code has been publicly released, increasing the risk of exploitation. FortiAuthenticator Cloud is not affected.

Impact

Successful exploitation allows an unauthenticated attacker to gain full control of the FortiAuthenticator appliance. This facilitates further malicious activity, such as lateral movement into integrated Active Directory or RADIUS environments.

Recommendation

• Upgrade to a patched version immediately: FortiAuthenticator 6.5.7 or later, 6.6.9 or later, or 8.0.3 or later.
• Restrict access to the FortiAuthenticator administration interface by requiring VPN access and implementing IP allowlisting.
• Disable all unnecessary API access until patching is complete.