FortiAuthenticator (<= 6.4.10, 6.5.0-6.5.6, 6.6.0-6.6.8, 8.0.0-8.0.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fortiauthenticator--6.4.10-6.5.0-6.5.6-6.6.0-6.6.8-8.0.0-8.0.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 02:48:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFortinet FortiAuthenticator: Unauthenticated remote code execution (CVE-2026-44277)https://feed.craftedsignal.io/briefs/2026-11-fortiauthenticator-rce/Wed, 04 Nov 2026 02:48:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-fortiauthenticator-rce/A critical unauthenticated remote code execution vulnerability (CVE-2026-44277) in FortiAuthenticator caused by improper access control on API endpoints now has public proof-of-concept exploit code available.CVE-2026-44277 is a critical remote code execution vulnerability in Fortinet FortiAuthenticator. The flaw exists due to improper access control on specific API endpoints, which allows unauthenticated attackers to execute arbitrary code on the appliance. Proof-of-concept exploit code has been publicly released, increasing the risk of exploitation. FortiAuthenticator Cloud is not affected.

Impact

Successful exploitation allows an unauthenticated attacker to gain full control of the FortiAuthenticator appliance. This facilitates further malicious activity, such as lateral movement into integrated Active Directory or RADIUS environments.

Recommendation

  • Upgrade to a patched version immediately: FortiAuthenticator 6.5.7 or later, 6.6.9 or later, or 8.0.3 or later.
  • Restrict access to the FortiAuthenticator administration interface by requiring VPN access and implementing IP allowlisting.
  • Disable all unnecessary API access until patching is complete.
]]>criticaladvisoryrcevulnerabilityapi-security