Loading vulnerability…
CVE-2023-26208 is an improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAuthenticator 6.4.x and earlier. The issue affects the login form, which can be targeted by a remote unauthenticated attacker using numerous HTTP requests. By repeatedly submitting requests to the authentication interface, an attacker can trigger excessive processing and resource consumption, leading to partial exhaustion of CPU and memory on the affected appliance.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a small Python proof-of-concept style automation tool (Tkinter GUI) labeled for CVE-2023-26208. Structure: - README.md: Portuguese description and usage instructions; states it is for educational testing, sends automated requests to /logincheck, and allows choosing target IP and payload size. - exploit.py: Standalone GUI application that validates an IPv4 address via regex, then repeatedly POSTs to https://<target_ip>/logincheck with form-encoded fields. The user controls payload_size, which determines the length of the injected username and password strings. The username is crafted as a leading single-quote followed by many 'A' characters and a trailing '#', which can be used to probe for SQL parsing behavior while also stressing input handling with large payloads. The script loops while a global 'running' flag is true, prints HTTP status and response body, sleeps 2 seconds between requests, and disables TLS verification (verify=False). No explicit RCE/reverse shell is implemented; the primary capability is network-based request flooding/oversized input testing against a login endpoint.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.