CVE-2026-126258: Buffer Overflow

Published Nov 11, 2026

Updated

A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiOS to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade Fortinet FortiOS to a version that resolves this vulnerability.
Fixed in 8.0.1

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

FortiOS 8.0.0 and FortiOS 7.6.7 systems are identified as affected. Exposure requires that an attacker can reach a wad port.

Does exploitation require authentication or user interaction?

No. The vulnerability may be exploited by an unauthenticated attacker using crafted HTTP or HTTPS requests, with no user interaction described.

What is the expected impact of a successful attack?

A successful exploit may crash proxy or ZTNA sessions, resulting in an availability impact. No confidentiality or integrity impact is identified in the provided severity vector.