Authentication Bypass Vulnerability in Fortinet FortiOS
CVE-2026-126253

9.3CRITICAL

Key Information:

Vendor

Fortinet
Status
FortiOS
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126253?

A vulnerability in Fortinet's FortiOS products allows an unauthenticated attacker to exploit an authentication bypass issue, enabling them to send specially crafted requests that could lead to the broadcasting of Link State Advertisement (LSA) messages. This threat potentially compromises network security and requires users of the affected versions to apply necessary patches promptly to safeguard their systems.

Affected Version(s)

FortiOS 8.0.0 <= 8.0.1

FortiOS 7.6.0 <= 7.6.7

FortiOS 7.4.0 <= 7.4.12

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-267

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.