Critical vulnerabilities
3 critical vulnerabilities in Fortinet FortiOS
3 vulnerabilities rated critical (CVSS 9.0 or higher) found on 11 November 2026: Authentication bypass in servers and applications.
- 3 critical
Fortinet FortiOS · Servers and applications
CVE-2026-126254
A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request
- Severity
- Critical 9.6
- Published
- 11 Nov 2026
- Weakness
- CWE-197
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Change data · Take it down
| Software | Affected versions |
|---|---|
| Fortinet FortiOSServers and applications |
|
| Fortinet FortiOSServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126254
Authentication bypass in Fortinet FortiOS · Servers and applications
CVE-2026-126253
A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request
- Severity
- Critical 9.3
- Published
- 11 Nov 2026
- Weakness
- CWE-305
- Attack
- From the same local network · No login needed · No user action needed
- Attacker can
- Change data · Take it down
| Software | Affected versions |
|---|---|
| Fortinet FortiOSServers and applications |
|
| Fortinet FortiOSServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126253
Fortinet FortiOS · Servers and applications
CVE-2026-126259
A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.
- Severity
- Critical 9.0
- Published
- 11 Nov 2026
- Weakness
- Missing authentication (CWE-306)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
| Software | Affected versions |
|---|---|
| Fortinet FortiOSServers and applications |
|
| Fortinet FortiOSServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126259
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.