Is CVE-2026-126255 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126255 being exploited in the wild.

How severe is CVE-2026-126255?

High severity, with a CVSS score of 7.4, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13; Fortinet Fortipam 1.0 through 1.6 all versions; Fortinet FortiProxy ; Fortinet Fortisase 25.1 through 26.3.1.

How is CVE-2026-126255 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-126255?

Check whether you run Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126255: Fortinet FortiOS path traversal authentication bypass in SSH daemon

CVE-2026-126255 · Severity: high · CVSS 7.4 · Published 2026-11-11

FortiOS is a network security appliance that protects corporate networks. An unauthenticated attacker can bypass authentication via specially crafted SSH credentials, potentially allowing unauthorized access to the appliance. This vulnerability affects multiple versions of FortiOS and related products, though it requires GPC OS Login to be enabled.

Technologies: Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy, Fortinet Fortisase. Vendors: Fortinet.

Quick answers

Is CVE-2026-126255 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126255 being exploited in the wild.
How severe is CVE-2026-126255?: High severity, with a CVSS score of 7.4, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13; Fortinet Fortipam 1.0 through 1.6 all versions; Fortinet FortiProxy <UNKNOWN>; Fortinet Fortisase 25.1 through 26.3.1.
Is there a fix for CVE-2026-126255?: Yes: fixed in FortiOS 8.0.2 or above, 7.6.8 or above, 7.4.13 or above, 7.2.14 or above; FortiSASE 26.3.2 or above; FortiPAM 1.7 or above. Until then: The product is impacted only if GPC OS Login is enabled; disable this feature to mitigate the vulnerability until an upgrade is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126255 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126255?: Check whether you run Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiOS 8.0.2 or above, 7.6.8 or above, 7.4.13 or above, 7.2.14 or above; FortiSASE 26.3.2 or above; FortiPAM 1.7 or above

The product is impacted only if GPC OS Login is enabled; disable this feature to mitigate the vulnerability until an upgrade is available.

Technical details

A path traversal vulnerability in the SSH daemon (sshd) improperly neutralizes special elements in output, allowing an unauthenticated attacker to bypass authentication. The attack occurs on the network via SSH and requires no authentication or user interaction. When GPC OS Login is enabled, an attacker can gain unauthorized access to the system.

Affected products

Fortinet FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13
Fortinet FortiPAM 1.0 through 1.6 all versions
Fortinet FortiSASE 25.1 through 26.3.1
Fortinet FortiProxy <UNKNOWN>

Timeline

2026-11-10: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-269

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.