UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126255

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated…

Severity
High 7.4
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
CWE-24
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
Sources
CVE Program

Description

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.

From the CVE Program.

Affected software

SoftwareAffected versions
Fortinet FortiOSServers and applications · cna:fortinet|fortios
  • From 7.2.0 up to 7.2.13
  • From 7.4.0 up to 7.4.12
  • From 7.6.0 up to 7.6.7
  • From 8.0.0 up to 8.0.1
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios
  • From 7.2.0 up to 7.2.13
  • From 7.4.0 up to 7.4.12
  • From 7.6.0 up to 7.6.7
  • From 8.0.0 up to 8.0.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126255