Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126253 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiOS |
| Vulnerability Type | authentication bypass by primary weakness (CWE-305) |
| CVSS Score | 9.3 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSAs via a specially crafted request.
LSAs (Link State Advertisements) are the messages link-state routers (OSPF) use to exchange topology information. The attack vector is adjacent (AV:A) — the attacker needs access to a segment where routing runs. Injected LSAs can redirect or block traffic in the network (scope changed, S:C).
Required Actions
- Update FortiOS to the version listed in Fortinet advisory FG-IR-26-267.
- Limit dynamic routing to trusted segments and set interfaces without routing neighbors as passive.
- Monitor routing tables and the link-state database for unexpected changes.
Who Is Affected?
The vulnerability affects Fortinet FortiOS 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12 and 7.2.0–7.2.13, especially on devices with link-state routing (OSPF) enabled. FortiOS is the operating system of FortiGate firewalls, widely deployed in enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126253 vulnerability?
CVE-2026-126253 is an authentication bypass by primary weakness flaw (CWE-305) in Fortinet FortiOS that allows an unauthenticated attacker to broadcast LSAs. CVSS score: 9.3.
Does exploiting CVE-2026-126253 require authentication?
No, but the attacker needs access to an adjacent network segment (AV:A) where routing runs.
How to protect against CVE-2026-126253?
Update FortiOS as per advisory FG-IR-26-267 and limit dynamic routing to trusted segments.
Who is affected by CVE-2026-126253?
Organizations running FortiGate with FortiOS 7.2–8.0.1, especially with OSPF enabled.
