CVE-2026-126256: High severity vulnerability
A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets.
Other sources
A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets.
— NVD
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Which FortiOS deployments are affected?
Affected releases are FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, and all versions of the 7.4, 7.2, and 7.0 branches.
Does an attacker need authentication to exploit this issue?
The vulnerability description says exploitation is by a remote privileged attacker, while the supplied CVSS vector lists PR:N, indicating no privileges required. The available data does not explain this discrepancy, so exposure should be assessed cautiously.