Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126259 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiOS |
| Vulnerability Type | missing authentication for critical function (CWE-306) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13 may allow an unauthenticated attacker, with HA FGSP + standalone-config-sync or autoscale configured, to execute commands as super admin via crafted HA packets.
Vulnerable are FortiGate firewalls running in an FGSP (FortiGate Session Life Support Protocol) cluster with standalone-config-sync enabled, or in autoscale mode (typical for cloud deployments). A successful attack means full takeover of the firewall.
Required Actions
- Update FortiOS to the version listed in Fortinet advisory FG-IR-26-273.
- Check whether you use FGSP with
standalone-config-syncor autoscale — if so, treat the update as a priority. - Until patched, isolate HA/synchronization interfaces and traffic in a dedicated segment unreachable from other networks.
- Review administrator accounts and firewall configuration change history for unauthorized modifications.
Who Is Affected?
The vulnerability affects Fortinet FortiOS 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.12 and 7.2.0–7.2.13 in HA FGSP configurations with standalone-config-sync or autoscale. FortiOS is the operating system of FortiGate firewalls, widely deployed in enterprises and public institutions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126259 vulnerability?
CVE-2026-126259 is a missing authentication for critical function flaw (CWE-306) in Fortinet FortiOS that allows command execution as super admin via crafted HA packets. CVSS score: 9.8.
Does exploiting CVE-2026-126259 require authentication?
No. The attack requires no authentication, but the firewall must run HA FGSP with standalone-config-sync or autoscale, and the attacker must be able to send HA packets to it.
How to protect against CVE-2026-126259?
Update FortiOS as per advisory FG-IR-26-273 and isolate HA traffic in a dedicated network segment.
Who is affected by CVE-2026-126259?
Organizations running FortiGate with FortiOS 7.2–8.0.0 in an FGSP cluster with standalone-config-sync or in autoscale mode.
