CVE-2026-126259: Critical severity vulnerability
A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.4.13 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 8.0.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires HA FGSP with standalone-config-sync enabled, or an autoscale deployment. The affected FortiOS releases are 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, and 7.2.0 through 7.2.13.
Does exploitation require credentials or user interaction?
No. An unauthenticated attacker can exploit the issue using crafted HA packets, with no user interaction indicated.
What level of access could successful exploitation provide?
Successful exploitation may allow execution of commands as a super administrator. This can affect confidentiality, integrity, and availability.