CVE-2026-21743

High

Published: 10 February 2026

Published

10 February 2026

Modified

12 February 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.3th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21743 is a high-severity Missing Authorization (CWE-862) vulnerability in Fortinet Fortiauthenticator. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-21743 is a missing authorization vulnerability (CWE-862) affecting Fortinet FortiAuthenticator versions 6.6.0 through 6.6.6, as well as all versions of 6.5, 6.4, and 6.3. The flaw enables a read-only user to modify local users by uploading a file to an unprotected endpoint, bypassing intended access controls. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

An attacker with read-only user privileges can exploit this vulnerability remotely over the network without user interaction. By leveraging the unprotected file upload endpoint, they can alter local user configurations, potentially escalating privileges, disrupting authentication services, or enabling further compromise within the environment.

For mitigation details, including available patches and workarounds, refer to the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-528. The vulnerability was published on 2026-02-10.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-6220

Vulnerability details

A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected…

endpoint.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authorization on file upload endpoint directly enables remote privilege escalation from read-only to local user modification (T1068/T1098) on a network-accessible auth service (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1