What is CVE-2026-44277?

CVE-2026-44277 is a critical-severity vulnerability in Fortinet Fortiauthenticator, classified under Improper Access Control. CVSS score: 9.8/10. Published 2026-05-12.

How severe is CVE-2026-44277?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2026-44277 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Fortinet Fortiauthenticator

CVE-2026-44277

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.

EPSS: 0.006 (44.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortinet Fortiauthenticator — versions 8.0.2, 8.0.0, 6.6.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

Public proof-of-concept exploits

0xBlackash/CVE-2026-44277

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-44277?: CVE-2026-44277 is a critical-severity vulnerability in Fortinet Fortiauthenticator, classified under Improper Access Control. CVSS score: 9.8/10. Published 2026-05-12.
How severe is CVE-2026-44277?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2026-44277 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.