Paper/Archive/CVE-2026-126259

CVE-2026-126259

Fortinet FortiOS — A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 throug…

CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.

Affected

ProductAffectedFixed inSource

FortiOS8.0.0–CNA

FortiOS7.6.0 – 7.6.7–CNA

FortiOS7.4.0 – 7.4.12–CNA

FortiOS7.2.0 – 7.2.13–CNA

FortiOS7.0.0 – 7.0.19–CNA

Scores by source

fortinet (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-273