CVE-2021-26088: Fortinet Single Sign-On

Critical severity, CVSS 9.6. EPSS: 1% chance of exploitation in the next 30 days.

An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and access the protected network via sending specifically crafted UDP login notification packets.

Affected products

• Fortinet Fortinet Single Sign-On: before 6.4.6 (fixed in 6.4.6); from 7.0.0, before 7.0.1 (fixed in 7.0.1)

Published 2021-07-12. Last modified 2026-06-17.