Is CVE-2026-126256 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126256 being exploited in the wild.

How severe is CVE-2026-126256?

High severity, with a CVSS score of 7.4, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiOS 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13; Fortinet Fortisase 22.0-26.3.1.

Is there a fix for CVE-2026-126256?

Yes: fixed in FortiOS 8.0.2 or above, 7.6.8 or above, 7.4.13 or above, 7.2.14 or above; FortiSASE 26.3.2 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126256 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-126256?

Check whether you run Fortinet FortiOS or Fortinet Fortisase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126256: Fortinet FortiOS out-of-bounds read in kernel

CVE-2026-126256 · Severity: high · CVSS 7.4 · Published 2026-11-11

FortiOS is a firewall operating system that protects corporate networks. An out-of-bounds read vulnerability in the kernel allows a remote attacker with elevated privileges to execute arbitrary code by sending specially crafted packets. This could lead to full compromise of the firewall and access to the networks it protects.

Technologies: Fortinet FortiOS, Fortinet Fortisase. Vendors: Fortinet.

Quick answers

Is CVE-2026-126256 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126256 being exploited in the wild.
How severe is CVE-2026-126256?: High severity, with a CVSS score of 7.4, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiOS 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13; Fortinet Fortisase 22.0-26.3.1.
Is there a fix for CVE-2026-126256?: Yes: fixed in FortiOS 8.0.2 or above, 7.6.8 or above, 7.4.13 or above, 7.2.14 or above; FortiSASE 26.3.2 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126256 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126256?: Check whether you run Fortinet FortiOS or Fortinet Fortisase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiOS 8.0.2 or above, 7.6.8 or above, 7.4.13 or above, 7.2.14 or above; FortiSASE 26.3.2 or above

Technical details

An out-of-bounds read/write vulnerability (CWE-125/CWE-787) in the FortiOS kernel allows a remote privileged attacker to execute arbitrary code via crafted packets. The vulnerability affects multiple versions of FortiOS across several major releases (7.0–8.0.1) and FortiSASE (22.0–26.3.1). The attack requires an authenticated, privileged account and a network connection to the device.

Affected products

Fortinet FortiOS 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13
Fortinet FortiSASE 22.0-26.3.1

Timeline

2026-11-10: disclosed
2026-11-11: advisory

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-270

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.