CVE-2026-21743

High

Published: 10 February 2026

Published

10 February 2026

Modified

12 February 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.2th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21743 is a high-severity Missing Authorization (CWE-862) vulnerability in Fortinet Fortiauthenticator. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 2 other techniques.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures

addresses: CWE-862

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

AC-13 Supervision and Review — Access Control

addresses: CWE-862

Reviews of access controls detect missing authorization checks on critical functions or resources.

AC-14 Permitted Actions Without Identification or Authentication

addresses: CWE-862

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

AC-16 Security and Privacy Attributes

addresses: CWE-862

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

AC-17 Remote Access

addresses: CWE-862

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

AC-18 Wireless Access

addresses: CWE-862

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

AC-19 Access Control for Mobile Devices

addresses: CWE-862

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

AC-2 Account Management

addresses: CWE-862

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authorization on file upload endpoint directly enables remote privilege escalation from read-only to local user modification (T1068/T1098) on a network-accessible auth service (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected…

endpoint.

Deeper analysisAI

CVE-2026-21743 is a missing authorization vulnerability (CWE-862) affecting Fortinet FortiAuthenticator versions 6.6.0 through 6.6.6, as well as all versions of 6.5, 6.4, and 6.3. The flaw enables a read-only user to modify local users by uploading a file to an unprotected endpoint, bypassing intended access controls. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

An attacker with read-only user privileges can exploit this vulnerability remotely over the network without user interaction. By leveraging the unprotected file upload endpoint, they can alter local user configurations, potentially escalating privileges, disrupting authentication services, or enabling further compromise within the environment.

For mitigation details, including available patches and workarounds, refer to the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-528. The vulnerability was published on 2026-02-10.