CVE-2021-36177: Fortinet Fortiauthenticator

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database.

Affected products

• Fortinet Fortiauthenticator: from 6.0.0, before 6.3.3 (fixed in 6.3.3)

Published 2022-02-02. Last modified 2026-06-17.