CVE-2021-26110

Published: Dec 8, 2021Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script and auto-script features.

Affected (10)

Products: Fortinet: Fortios, Fortiproxy

Fortinet

2 products

Fortios

Fortiproxy

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	5.6.0 ≤ version ≤ 5.6.14
Fortinet Fortios	6.0.0 ≤ version ≤ 6.0.12
Fortinet Fortios	6.2.0 ≤ version ≤ 6.2.9
Fortinet Fortios	6.4.0 ≤ version ≤ 6.4.6
Fortinet Fortios	Version 7.0.0
Fortinet Fortiproxy	1.0.0 ≤ version ≤ 1.0.7
Fortinet Fortiproxy	1.1.0 ≤ version ≤ 1.1.6
Fortinet Fortiproxy	1.2.0 ≤ version ≤ 1.2.9
Fortinet Fortiproxy	Version 2.0.0
Fortinet Fortiproxy	Version 2.0.1

References (2)

https://fortiguard.com/advisory/FG-IR-20-131

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/advisory/FG-IR-20-131

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.