Missing Authentication Vulnerability in Fortinet FortiOS Products
CVE-2026-126259

9CRITICAL

Key Information:

Vendor

Fortinet
Status
FortiOS
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126259?

A missing authentication vulnerability in Fortinet FortiOS allows an unauthenticated attacker to execute commands with super admin privileges by exploiting crafted HA packets. This security flaw affects various versions, creating potential risks for organizations utilizing the affected FortiOS products, especially those reliant on HA FGSP and standalone configurations.

Affected Version(s)

FortiOS 8.0.0

FortiOS 7.6.0 <= 7.6.7

FortiOS 7.4.0 <= 7.4.12

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-273

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.