NCSC-2026-0244 [1.00] [M/H] Vulnerability fixed in Fortinet FortiAuthenticator
Fortinet has fixed a vulnerability in FortiAuthenticator. The vulnerability concerns an out-of-bounds read in FortiAuthenticator versions 6.5 and 6.6.0 to 6.6.2. An external, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, leading to unauthorized access to sensitive information. The vulnerability arises from improper bounds checking during request processing, allowing memory outside the intended bounds to be accessed.
CSIRTS triage
- What
- An out-of-bounds read vulnerability allows unauthorized access to sensitive information.
- Who is affected
- Deployments of FortiAuthenticator versions 6.5 and 6.6.0 to 6.6.2 are affected.
- Urgency
- Remediation is urgent due to the risk of unauthorized information access.
- Action
- Update FortiAuthenticator to the latest version to resolve this issue.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch FortiAuthenticator
Get an email when a new FortiAuthenticator advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0244
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-533790.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-53379 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30