Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126254 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiOS |
| Vulnerability Type | numeric truncation error (CWE-197) |
| CVSS Score | 9.6 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13 may allow a configured iBGP neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request.
The flaw affects FortiGate firewalls exchanging routes over iBGP. The attacker must control a configured BGP neighbor (e.g. a compromised router or another firewall in the same autonomous system), but the impact goes beyond the device itself (scope changed, S:C) — malformed attributes can propagate across the routing domain and disrupt it.
Required Actions
- Update FortiOS to the version listed in Fortinet advisory FG-IR-26-268.
- Identify firewalls with configured iBGP sessions and prioritize them for the update.
- Verify the list of BGP neighbors and use BGP session authentication and attribute filters where possible.
Who Is Affected?
The vulnerability affects Fortinet FortiOS 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12 and 7.2.0–7.2.13 on devices with iBGP enabled — typically in larger networks with dynamic routing, SD-WAN and multiple branches. FortiOS is the operating system of FortiGate firewalls, widely deployed in enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126254 vulnerability?
CVE-2026-126254 is a numeric truncation error (CWE-197) in Fortinet FortiOS BGP handling that allows an iBGP neighbor to propagate malicious attributes to connected routers. CVSS score: 9.6.
Does exploiting CVE-2026-126254 require authentication?
Partly. The attacker must be a configured iBGP neighbor (low privileges required, PR:L), e.g. by compromising a router in the network.
How to protect against CVE-2026-126254?
Update FortiOS as per advisory FG-IR-26-268 and verify BGP neighbors and session authentication.
Who is affected by CVE-2026-126254?
Organizations running FortiGate with FortiOS 7.2–8.0.1 and configured iBGP routing.
