{"id":"CVE-2026-126253","kind":"vulnerability","aliases":["CVE-2026-126253"],"related":[],"title":"Fortinet FortiOS: unauthenticated attacker can broadcast OSPF LSA packets via crafted request","description":"A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request","summary":"A flaw in Fortinet FortiOS authentication lets an unauthenticated attacker broadcast LSA (OSPF link-state) messages using a specially crafted request. The sources give a CVSS score of 9.3 but do not describe further consequences.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiOS","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiOS 7.6","fixed":["7.6.8"],"affected":">= 7.6.0, <= 7.6.7","ecosystem":"vendor"},{"name":"FortiOS 7.4","fixed":["7.4.13"],"affected":">= 7.4.0, <= 7.4.12","ecosystem":"vendor"},{"name":"FortiOS 7.2","fixed":["7.2.14"],"affected":">= 7.2.0, <= 7.2.13","ecosystem":"vendor"},{"name":"FortiOS 7.0","fixed":[],"affected":">= 7.0.1, <= 7.0.19","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent-network","firewall","fortinet","fortios","fortisase","infrastructure","ospf","routing"],"not_affected_if":["fortisase-24.4-or-earlier","fortisase-26.3.2-or-later"],"how_to_check":"Run 'get system status' on each FortiGate (or see Dashboard) and compare the version: affected are 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13, 7.0.1-7.0.19. The flaw is in the OSPF daemon and the CVSS vector is adjacent-network (AV:A); check whether OSPF is configured ('show router ospf') and which interfaces carry it. Fortinet's page does not state whether OSPF must be enabled, so treat any affected version as exposed until you have upgraded.","fix":"Upgrade FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 (or later). FortiOS 7.0 (7.0.1-7.0.19): migrate to a fixed release. FortiSASE 26.3.1 already remediated by Fortinet in 26.3.2; FortiSASE 25.x-26.2 migrate.","status":"open","published_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:05+00:00","updated_at":"2026-11-11T22:32:20+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Fortinet FortiOS: unauthenticated attacker can broadcast LSA packets via crafted request","impact":"high","summary":"A flaw in Fortinet FortiOS authentication lets an unauthenticated attacker broadcast LSA (OSPF link-state) messages using a specially crafted request. The sources give a CVSS score of 9.3 but do not describe further consequences.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortinet","fortios","firewall"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unknown; attacker can inject routing link-state broadcasts unauthenticated","analyst_note":"Check the Fortinet PSIRT advisory for CVE-2026-126253 for the fixed versions, reachable interfaces, and whether OSPF must be enabled.","how_to_check":"- Check the FortiOS version on the device: unknown beyond the affected ranges (8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, or 7.2.0 through 7.2.13 are in the listed ranges. The sources do not say which configurations or interfaces are needed to reach the flaw, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00076,"input_tokens":4604,"output_tokens":600,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for CVE-2026-126253 for the fixed versions, reachable interfaces, and whether OSPF must be enabled.","search":"'-126253':15A,18A '-2026':14A,17A '7.0':27A '7.2':25A '7.2.0':96C '7.2.13':98C '7.4':23A '7.4.0':92C '7.4.12':94C '7.6':21A '7.6.0':88C '7.6.7':90C '8.0.0':84C '8.0.1':86C '9.3':67B 'adjac':29B 'adjacent-network':28B 'allow':100C 'attack':4A,47B,103C 'authent':43B,75C 'broadcast':6A,48B,105C 'bypass':76C 'consequ':73B 'craft':11A,58B,109C 'cve':13A,16A 'cvss':64B 'describ':71B 'firewal':31B 'flaw':39B 'fortinet':1A,32B,41B,82C 'fortio':2A,33B,42B,83C,87C,91C,95C 'fortios':19A,20A,22A,24A,26A 'fortisas':34B 'give':62B 'infrastructur':35B 'let':44B 'link':52B 'link-stat':51B 'lsa':8A,49B,106C 'may':99C 'messag':54B 'network':30B 'ospf':7A,36B,50B 'packet':9A 'primari':78C 'request':12A,59B,110C 'rout':37B 'score':65B 'sourc':61B 'special':57B,108C 'state':53B 'unauthent':3A,46B,102C 'use':55B 'via':10A,107C 'vulner':80C 'weak':79C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiGate firewalls on FortiOS 7.0 to 8.0.1 in the listed ranges. The flaw is in the OSPF routing daemon and the vendor's vector is adjacent-network, so look first at firewalls that run OSPF toward untrusted or shared segments. Fortinet does not say OSPF must be enabled; sites without OSPF may be lower risk but should still upgrade. FortiSASE 26.3.1 needs no action.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:32:20Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267","run_id":3603},"products":{"at":"2026-11-11T22:32:20Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267","run_id":3603}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["70","72","74","76","fortios","fortios70","fortios72","fortios74","fortios76"],"ptokens":["fortios"],"labels":["adjacentnetwork","critical","firewall","fortinet","fortios","fortisase","infrastructure","ospf","routing"],"campaign_type":null,"search_a":"'-126253':15A,18A '-2026':14A,17A '7.0':27A '7.2':25A '7.4':23A '7.6':21A 'attack':4A 'broadcast':6A 'craft':11A 'cve':13A,16A 'fortinet':1A 'fortio':2A 'fortios':19A,20A,22A,24A,26A 'lsa':8A 'ospf':7A 'packet':9A 'request':12A 'unauthent':3A 'via':10A","search_b":"'9.3':67B 'adjac':29B 'adjacent-network':28B 'attack':47B 'authent':43B 'broadcast':48B 'consequ':73B 'craft':58B 'cvss':64B 'describ':71B 'firewal':31B 'flaw':39B 'fortinet':32B,41B 'fortio':33B,42B 'fortisas':34B 'give':62B 'infrastructur':35B 'let':44B 'link':52B 'link-stat':51B 'lsa':49B 'messag':54B 'network':30B 'ospf':36B,50B 'request':59B 'rout':37B 'score':65B 'sourc':61B 'special':57B 'state':53B 'unauthent':46B 'use':55B","search_c":"'7.2.0':96C '7.2.13':98C '7.4.0':92C '7.4.12':94C '7.6.0':88C '7.6.7':90C '8.0.0':84C '8.0.1':86C 'allow':100C 'attack':103C 'authent':75C 'broadcast':105C 'bypass':76C 'craft':109C 'fortinet':82C 'fortio':83C,87C,91C,95C 'lsa':106C 'may':99C 'primari':78C 'request':110C 'special':108C 'unauthent':102C 'via':107C 'vulner':80C 'weak':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126253","severity":null,"published_at":"2026-11-11T22:17:25+00:00","modified_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126253:3603","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267","severity":null,"published_at":"2026-11-11T22:32:20+00:00","modified_at":"2026-11-11T22:32:20+00:00","first_seen_at":"2026-11-11T22:32:20+00:00","fetched_at":"2026-11-11T22:32:20+00:00","note":"Read Fortinet PSIRT FG-IR-26-267: fixed versions and affected ranges confirmed; vendor page does not say OSPF must be enabled or give a workaround. Not exploited per vendor. Web search worked; X skipped.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-267"]}],"documents":[{"id":129638,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267","title":"Fortinet PSIRT FG-IR-26-267: Authentication bypass by primary weakness","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}