CVE-2026-21743

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21743", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-01-05T14:17:53.224Z", "datePublished": "2026-02-10T15:39:11.799Z", "dateUpdated": "2026-02-12T00:27:03.410Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiAuthenticator", "cpes": ["cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "6.6.0", "lessThanOrEqual": "6.6.6", "status": "affected"}, {"versionType": "semver", "version": "6.5.0", "lessThanOrEqual": "6.5.7", "status": "affected"}, {"versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.11", "status": "affected"}, {"versionType": "semver", "version": "6.3.0", "lessThanOrEqual": "6.3.5", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-02-12T00:27:03.410Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "Improper access control", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiAuthenticator version 8.0.0 or above\nUpgrade to FortiAuthenticator version 6.6.7 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-528", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-528"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T16:26:05.549911Z", "id": "CVE-2026-21743", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:26:12.930Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T16:26:05.549911Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:26:10.477Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiAuthenticator", "versions": [{"status": "affected", "version": "6.6.0", "versionType": "semver", "lessThanOrEqual": "6.6.6"}, {"status": "affected", "version": "6.5.0", "versionType": "semver", "lessThanOrEqual": "6.5.7"}, {"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.11"}, {"status": "affected", "version": "6.3.0", "versionType": "semver", "lessThanOrEqual": "6.3.5"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiAuthenticator version 8.0.0 or above\nUpgrade to FortiAuthenticator version 6.6.7 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-528", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-528"}], "descriptions": [{"lang": "en", "value": "A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Improper access control"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-02-12T00:27:03.410Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21743", "state": "PUBLISHED", "dateUpdated": "2026-02-12T00:27:03.410Z", "dateReserved": "2026-01-05T14:17:53.224Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-02-10T15:39:11.799Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiAuthenticator", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "6.6.6", "status": "affected", "version": "6.6.0", "versionType": "semver"}, {"lessThanOrEqual": "6.5.7", "status": "affected", "version": "6.5.0", "versionType": "semver"}, {"lessThanOrEqual": "6.4.11", "status": "affected", "version": "6.4.0", "versionType": "semver"}, {"lessThanOrEqual": "6.3.5", "status": "affected", "version": "6.3.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1683FD1-9BDE-4596-9DBC-F146922E022C", "versionEndExcluding": "6.6.7", "versionStartIncluding": "6.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n faltante en Fortinet FortiAuthenticator 6.6.0 hasta 6.6.6, FortiAuthenticator 6.5 todas las versiones, FortiAuthenticator 6.4 todas las versiones, FortiAuthenticator 6.3 todas las versiones puede permitir a un usuario de solo lectura realizar modificaciones a usuarios locales a trav\u00e9s de una carga de archivo a un endpoint desprotegido."}], "id": "CVE-2026-21743", "lastModified": "2026-06-17T10:18:59.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21743", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T16:26:05.549911Z", "version": "2.0.3"}}]}, "published": "2026-02-10T16:16:10.903", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-528"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.0,6.6.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.5.0,6.5.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.4.0,6.4.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.3.0,6.3.5]"}}], "product": "fortiauthenticator", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-17T20:47:44.653918+00:00", "value": {"mitigation_remediation": ["Upgrade FortiAuthenticator to version\u202f6.6.7 or\u202f8.0.0 to apply the authorization fix.", "Restrict access to the file\u2011upload endpoint so that only administrative users can use it, or block the endpoint entirely for read\u2011only users via firewall or ACL rules.", "Disable or remove unused local user accounts and enforce the principle of least privilege to ensure no account with read\u2011only status can perform file uploads."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized User Modification"}, "threat_synthesis": {"affected_systems": "Vendors and products impacted include Fortinet FortiAuthenticator. Versions affected are all releases from 6.3.0 through 6.6.6, as well as all 6.5 and 6.4 release lines. The advisory recommends upgrading to version 6.6.7 or later, or to 8.0.0 for more recent builds.", "description_and_impact": "A missing authorization flaw in Fortinet FortiAuthenticator allows a user with read\u2011only privileges to modify local user accounts by uploading a file to an unprotected endpoint. The attack can change account attributes, potentially enabling privilege escalation and compromising the device\u2019s authentication mechanisms. This weakness corresponds to CWE\u2011862, which focuses on the absence of proper authorization checks.", "risk_and_exploitability": "The CVSS v3.1 base score of 6.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an adversary who can obtain or impersonate a read\u2011only user account, then use the unprotected endpoint on the protected network to upload a crafted file that alters local user entries. Successful exploitation would grant the attacker the ability to create, edit, or delete user accounts."}}}}, "created": "2026-02-10T21:42:09.546676+00:00", "title": "Authorization Bypass via Unprotected File Upload Enabling Unauthorized User Modifications", "updated": "2026-04-17T21:00:12.681129+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$fortiauthenticator"]}