Fortinet FortiOS: Improper authentication in RADIUS two-factor admin login
Summary
FortiOS 7.6.0 through 7.6.6 may accept an invalid two-factor token for remote RADIUS administrator accounts. An attacker who already knows a valid username and password, and holds at least read-only admin rights, can log in to the FortiOS GUI. The flaw applies only when the RADIUS server returns an additional Access-Challenge after an invalid token.
Affected
- FortiOS 7.6.0 through 7.6.6
- Only with Remote RADIUS type administrator accounts using two-factor authentication
- FortiOS 7.4, 7.2 and 8.0 are not affected according to the vendor
Fixed in
- Upgrade to FortiOS 7.6.7 or later
- FortiOS 8.0.0 or later is not affected according to the vendor
Workaround
- Delete the Remote RADIUS type administrator accounts that are linked to the RADIUS server returning Access-Challenge (GUI: System > Administrators; CLI: config system admin, delete, next, end)
- Note: this removes remote RADIUS admin logins entirely; coordinate with affected administrators first
- Local administrator accounts are not covered by this workaround
Exploitation
- No exploitation in the wild found; Known Exploited: no
- CISA SSVC: exploitation none, automatable no, technical impact total
- Public proof-of-concept: unknown; one third-party page reports a public exploit, not verified
- Vendor credits Juan A. Zavala (EchoStar/HUGHES) with responsible disclosure
Our recommendation
- Check the FortiOS version of all FortiGate devices and upgrade anything on 7.6.0 to 7.6.6 to 7.6.7 or later
- Check whether any administrators use RADIUS-based login with two-factor authentication
- If patching is delayed, apply the workaround after agreeing with the administrators
- Make sure the admin GUI is not reachable from the internet and review admin logs for logins with invalid tokens
- Recheck the NVD entry and proof-of-concept sources in the coming days
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortinet PSIRT advisory FG-IR-26-195 fortiguard.fortinet.com
- CVE Record CVE-2026-121530 (CVE.org) www.cve.org
- Strix CVE details CVE-2026-121530 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:41.
Original description (NVD)
A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.