CVE-2021-22124: Fortinet Fortiauthenticator

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters.

Affected products

• Fortinet Fortiauthenticator: from 4.0.0, up to and including 4.3.4; from 5.0.0, up to and including 5.5.0; from 6.0.0, before 6.0.6 (fixed in 6.0.6)
• Fortinet FortiSandbox: from 3.0.0, before 3.0.7 (fixed in 3.0.7); from 3.1.0, before 3.1.5 (fixed in 3.1.5); from 3.2.0, before 3.2.2 (fixed in 3.2.2)

Published 2021-08-04. Last modified 2026-06-17.