CVE-2026-44277 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-44277 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-44277 is a critical improper access control vulnerability affecting multiple versions of Fortinet FortiAuthenticator, a widely deployed multi-factor authentication and identity management appliance.

Technical Detail

The flaw stems from insufficient access control enforcement within FortiAuthenticator, affecting versions 8.0.0, 8.0.2, 6.6.0 through 6.6.8, and 6.5.0 through 6.5.6. The specific attack vector has not been fully disclosed in the current advisory, but the vulnerability class allows an attacker to execute unauthorized code or commands on the affected system, consistent with remote code execution or command injection primitives. Given that FortiAuthenticator serves as an authentication gateway, successful exploitation could result in full compromise of the authentication infrastructure, enabling lateral movement, credential theft, or bypass of MFA controls across dependent systems.

Exploitation Status

A proof-of-concept exploit is publicly available as of this writing. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, meaning active in-the-wild exploitation has not been formally confirmed by CISA. However, the availability of a PoC combined with the critical CVSS score of 9.8 significantly lowers the barrier for exploitation and warrants urgent attention.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No known campaigns or targeted sector activity has been linked to this CVE in available intelligence. Organizations in sectors that commonly deploy FortiAuthenticator, including financial services, government, and critical infrastructure, should treat this as an elevated risk given the nature of the affected product.

What To Do

Organizations running FortiAuthenticator versions 6.5.0 through 6.5.6, 6.6.0 through 6.6.8, 8.0.0, or 8.0.2 should prioritize patching immediately and consult Fortinet's official security advisory for confirmed fixed versions. Until patching is complete, restrict administrative and network access to FortiAuthenticator interfaces to trusted IP ranges only, and review authentication logs for anomalous access patterns or unexpected command execution. Given the PoC availability and the critical role FortiAuthenticator plays in identity infrastructure, this should be treated as a high-priority remediation item regardless of KEV status.