Is CVE-2026-126259 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126259 being exploited in the wild.

How severe is CVE-2026-126259?

Critical severity, with a CVSS score of 9.8, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiOS 7.0 all versions, 7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, 8.0.0.

How is CVE-2026-126259 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-126259?

Check whether you run Fortinet FortiOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126259: Fortinet FortiOS authentication bypass in HA command execution

CVE-2026-126259 · Severity: critical · CVSS 9.8 · Published 2026-11-11

FortiOS is a firewall operating system that protects corporate networks and can synchronize configuration across redundant devices using High Availability (HA). An unauthenticated attacker on the adjacent network can execute arbitrary commands with super administrator privileges by sending crafted HA packets, potentially leading to full device compromise and network breach.

Technologies: Fortinet FortiOS. Vendors: Fortinet.

Quick answers

Is CVE-2026-126259 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126259 being exploited in the wild.
How severe is CVE-2026-126259?: Critical severity, with a CVSS score of 9.8, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiOS 7.0 all versions, 7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, 8.0.0.
Is there a fix for CVE-2026-126259?: Yes: fixed in FortiOS 7.2.14, 7.4.13, 7.6.8, 8.0.1 or above. Until then: Apply the virtual patch "FG-VD-61445.0day" available in FMWP database update 26.082, or restrict adjacent network access to HA interfaces where possible until patching is complete. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126259 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-126259?: Check whether you run Fortinet FortiOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiOS 7.2.14, 7.4.13, 7.6.8, 8.0.1 or above

Apply the virtual patch "FG-VD-61445.0day" available in FMWP database update 26.082, or restrict adjacent network access to HA interfaces where possible until patching is complete.

Technical details

Missing authentication in a critical function (CWE-306) allows unauthenticated adjacent network attackers to execute super admin commands on FortiOS devices configured with HA FGSP standalone-config-sync or autoscale via malicious HA packets. The vulnerability affects multiple versions from 7.0 through 8.0.0. Fixes are available in FortiOS 7.2.14, 7.4.13, 7.6.8, and 8.0.1 or later; a virtual patch is also available.

Affected products

Fortinet FortiOS 7.0 all versions, 7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, 8.0.0

Timeline

2026-11-10: disclosed: Initial publication by Fortinet PSIRT
2026-11-11: advisory: NVD entry published

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-273

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.