Fortinet disclosed FortiOS flaw CVE-2026-126259 on November 10, 2026: on devices using HA FGSP with standalone-config-sync or autoscale, an unauthenticated attacker can send crafted HA packets to run commands as super admin, rated Critical with CVSSv3 9.0 [1]. A BGP daemon flaw, CVE-2026-126254 (CVSSv3 9.6), and an OSPF daemon authentication bypass, CVE-2026-126253 (CVSSv3 9.3), disclosed the same day are also rated Critical, and Fortinet lists none of the three as exploited [2][3][4]. FortiOS users should upgrade to 7.2.14, 7.4.13, 7.6.8 or 8.0.2 and above via the recommended upgrade path, and those exposed to CVE-2026-126259 who cannot upgrade yet can apply the virtual patch in FMWP 26.082 [1][2][3].
FortiOS fixes three Critical flaws, one allowing unauthenticated super-admin command execution in certain HA setups
1 min read
- Disclosed
- Nov 10, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- 0.6%, higher than 52% of CVEs
- Exploitation and patch status
- Patch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: Fortinet FortiOS, Fortinet FortiSASE
What to do nowOur advice
FortiOS users should upgrade to 7.2.14, 7.4.13, 7.6.8 or 8.0.2 and above via the recommended upgrade path, and those exposed to CVE-2026-126259 who cannot upgrade yet can apply the virtual patch in FMWP 26.082
Affected scope
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
Vendor guidance
- 1
- 2Apply virtual patch mitigate[1]
If HA FGSP with standalone-config-sync or autoscale is enabled and you cannot upgrade yet, apply FG-VD-61445.0day from FMWP db update 26.082.
References
Official / primary3
- [1]Fortinet PSIRT2026-11-10Accessed 2026-11-11Snapshot 2026-11-11 sha256 f790740ca6ac
“A missing authentication for critical function vulnerability [CWE-306] in FortiOS may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.