{"affected":[{"defaultStatus":"unaffected","product":"FortiOS","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"cveId":"CVE-2026-121530","cwes":["CWE-287"],"description":"A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: fortinet","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","version":"3.1"},{"score":6.6,"severity":"medium","source":"NVD: psirt@fortinet.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794374370393,"publishedAt":1794341436515,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-195"},{"source":"psirt@fortinet.com","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-195"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.7 or above"}],"revision":"de91707f8e8488a80f3cae38149fc1415cce7ba6a3f1ec80ba167855b2dfd815","sources":[{"modifiedAt":1794373084327,"name":"CNA: fortinet","retrievedAt":1794373797303,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121530"},{"modifiedAt":1794374370393,"name":"NVD","retrievedAt":1794377928080,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121530"}],"ssvc":{"assessedAt":1794268800000,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-121530","updatedAt":1794377928080}