🚨 CVE-2026-44277 - FortiAuthenticator Unauthenticated RCE

Critical Unauthenticated Remote Code Execution in Fortinet FortiAuthenticator

📋 Overview

CVE-2026-44277 is a critical vulnerability in Fortinet FortiAuthenticator that allows unauthenticated attackers to achieve Remote Code Execution (RCE) via improper access control on specific API endpoints.

🛠 Affected Versions

Product	Vulnerable Versions	Fixed Versions
FortiAuthenticator	6.5.0 - 6.5.6	6.5.7+
FortiAuthenticator	6.6.0 - 6.6.8	6.6.9+
FortiAuthenticator	8.0.0 - 8.0.2	8.0.3+

Note: FortiAuthenticator Cloud is not affected.

⚡ Impact

Unauthenticated Remote Code Execution
Full compromise of the appliance
Potential lateral movement into Active Directory / RADIUS environments
High risk for organizations using FortiAuthenticator for 2FA, RADIUS, or SAML

🧪 PoC Usage

python3 CVE-2026-44277.py http://target-ip

Example Output (Vulnerable):

[*] Testing → /api/v1/aaa → Reachable
[!!] Potential vulnerable endpoint found!
[!!] Target is likely vulnerable to CVE-2026-44277

🛡️ Mitigation

Upgrade immediately to the latest patched version
Restrict access to FortiAuthenticator admin interface (use VPN + IP allowlist)
Disable unnecessary API access

🔍 Shodan / FoFa Dorks

FoFa:

app="Fortinet-FortiAuthenticator"

Shodan:

"FortiAuthenticator" port:443

CVE-2026-44277

Most Popular