CyberSec.Space Logo
Back to CVE Browser

CVE-2021-26110

HIGH
7.8
CVSS Severity Score
EPSS Score0.1240%
EPSS Percentile18.32th
PublishedDec 8, 2021
Last ModifiedNov 21, 2024

Vulnerability Description

An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script and auto-script features.

Affected Platforms (CPE)

📦
Fortinet

Fortiproxy

>= 1.0.0 and <= 1.0.7
📦
Fortinet

Fortiproxy

>= 1.1.0 and <= 1.1.6
📦
Fortinet

Fortiproxy

>= 1.2.0 and <= 1.2.9
📦
Fortinet

Fortiproxy

= 2.0.0
📦
Fortinet

Fortiproxy

= 2.0.1
💻
Fortinet

Fortios

>= 5.6.0 and <= 5.6.14
💻
Fortinet

Fortios

>= 6.0.0 and <= 6.0.12
💻
Fortinet

Fortios

>= 6.2.0 and <= 6.2.9
💻
Fortinet

Fortios

>= 6.4.0 and <= 6.4.6
💻
Fortinet

Fortios

= 7.0.0

References & Advisories

🔗 https://fortiguard.com/advisory/FG-IR-20-131
🔗 https://fortiguard.com/advisory/FG-IR-20-131

Related Vulnerabilities

CVE-2026-248589.8

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 ...

CVE-2025-597189.8

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7....

CVE-2018-133829.1

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0....

CVE-2018-133799.1

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6...