{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afortinetfortiauthenticator/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-44277"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiAuthenticator (\u003c= 6.4.10, 6.5.0-6.5.6, 6.6.0-6.6.8, 8.0.0-8.0.2)"],"_cs_severities":["critical"],"_cs_tags":["rce","vulnerability","api-security"],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eCVE-2026-44277 is a critical remote code execution vulnerability in Fortinet FortiAuthenticator. The flaw exists due to improper access control on specific API endpoints, which allows unauthenticated attackers to execute arbitrary code on the appliance. Proof-of-concept exploit code has been publicly released, increasing the risk of exploitation. FortiAuthenticator Cloud is not affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to gain full control of the FortiAuthenticator appliance. This facilitates further malicious activity, such as lateral movement into integrated Active Directory or RADIUS environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version immediately: FortiAuthenticator 6.5.7 or later, 6.6.9 or later, or 8.0.3 or later.\u003c/li\u003e\n\u003cli\u003eRestrict access to the FortiAuthenticator administration interface by requiring VPN access and implementing IP allowlisting.\u003c/li\u003e\n\u003cli\u003eDisable all unnecessary API access until patching is complete.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T02:48:41Z","date_published":"2026-11-04T02:48:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fortiauthenticator-rce/","summary":"A critical unauthenticated remote code execution vulnerability (CVE-2026-44277) in FortiAuthenticator caused by improper access control on API endpoints now has public proof-of-concept exploit code available.","title":"Fortinet FortiAuthenticator: Unauthenticated remote code execution (CVE-2026-44277)","url":"https://feed.craftedsignal.io/briefs/2026-11-fortiauthenticator-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}