FortiAuthenticator Unauthenticated RCE Endpoint Probe (CVE-2026-44277)

Metadata

Affected Target

Summary

CVE-2026-44277 is described by the vendor/advisory as an unauthenticated remote code execution vulnerability in Fortinet FortiAuthenticator, caused by improper access control on specific API endpoints. The included script is a reconnaissance/detection tool only: it probes a small set of candidate API paths (/api/v1/aaa, /api/v1/fortiauth, /api/v1/config, /api/v1/backup, /api/v1/import) to determine whether they are reachable and flags reachable endpoints as “potentially vulnerable.” It explicitly does not include a working RCE payload — the author notes this is withheld “for safety.” Treat this repo as an exposure/reachability checker for the advisory, not a full working exploit chain.

Vulnerability Details

Root Cause

Per the advisory, specific FortiAuthenticator API endpoints lack proper access control, allowing unauthenticated requests to reach functionality that should require authentication, ultimately enabling remote code execution. The exact vulnerable endpoint, request method, and payload structure that achieve code execution are not disclosed in this repository.

Attack Vector

1. Attacker identifies a reachable FortiAuthenticator instance (e.g. via Shodan/FOFA dork app="Fortinet-FortiAuthenticator" or "FortiAuthenticator" port:443).
2. Attacker (or this script) sends unauthenticated GET requests to a list of candidate /api/v1/* paths.
3. Endpoints returning HTTP 200/403/500 with a non-trivial response body are flagged as reachable and “potentially vulnerable.”
4. The actual RCE trigger (payload/endpoint/method that achieves code execution) is not included in this PoC.

Impact

If exploited per the advisory, this would allow full unauthenticated compromise of the FortiAuthenticator appliance, with potential lateral movement into AD/RADIUS/SAML-integrated environments. As shipped, this specific script only establishes whether the advertised API surface is exposed — it does not itself achieve code execution.

Environment / Lab Setup

No lab/target is bundled. Point the script at a FortiAuthenticator instance you are
authorized to test:

  python3 CVE-2026-44277.py http://target-ip

Proof of Concept

PoC Script

See CVE-2026-44277.py in this folder.

1

python3 CVE-2026-44277.py http://target-ip

Running the script prints, per candidate endpoint, whether it is reachable (HTTP 200/403/500 with a substantial body) and labels reachable ones as potentially vulnerable. It ends with an explicit note that full RCE requires a specific payload not included in the script, and a reminder to patch to 6.5.7 / 6.6.9 / 8.0.3 or later.

Detection & Indicators of Compromise

- Unauthenticated HTTP requests from a single source to /api/v1/aaa, /api/v1/fortiauth,
  /api/v1/config, /api/v1/backup, /api/v1/import in rapid succession — consistent with
  this scanner or similar reconnaissance.
- Any successful unauthenticated access to these endpoints in FortiAuthenticator's own
  access/audit logs.

Signs of compromise:

• Unexpected admin/API activity (config changes, backup/import operations) not tied to a known authenticated session.
• New or modified accounts, RADIUS/SAML configuration, or scheduled tasks on the appliance.
• Outbound connections or process activity from the FortiAuthenticator appliance inconsistent with its normal role.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/0xBlackash/CVE-2026-44277 on 2026-07-05. The upstream repository provides only an endpoint-reachability probe, not a functional RCE trigger; the author states the actual exploit payload was withheld.