---
id: "CVE-2026-126253"
page: "https://infrastack.ai/live/CVE-2026-126253"
kind: "vulnerability"
aliases: ["CVE-2026-126253"]
title: "Fortinet FortiOS: unauthenticated attacker can broadcast OSPF LSA packets via crafted request"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiOS", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiOS 7.6", "fixed": ["7.6.8"], "affected": ">= 7.6.0, <= 7.6.7", "ecosystem": "vendor"}, {"name": "FortiOS 7.4", "fixed": ["7.4.13"], "affected": ">= 7.4.0, <= 7.4.12", "ecosystem": "vendor"}, {"name": "FortiOS 7.2", "fixed": ["7.2.14"], "affected": ">= 7.2.0, <= 7.2.13", "ecosystem": "vendor"}, {"name": "FortiOS 7.0", "fixed": [], "affected": ">= 7.0.1, <= 7.0.19", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adjacent-network", "firewall", "fortinet", "fortios", "fortisase", "infrastructure", "ospf", "routing"]
not_affected_if: ["fortisase-24.4-or-earlier", "fortisase-26.3.2-or-later"]
published_at: "2026-11-11T22:17:25+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:32:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126253", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-267", "first_seen_at": "2026-11-11T22:32:20+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-267"]}]
exploit_sources: []
---

# Fortinet FortiOS: unauthenticated attacker can broadcast OSPF LSA packets via crafted request

Link for people: https://infrastack.ai/live/CVE-2026-126253 (this .md is for agents)

A flaw in Fortinet FortiOS authentication lets an unauthenticated attacker broadcast LSA (OSPF link-state) messages using a specially crafted request. The sources give a CVSS score of 9.3 but do not describe further consequences.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiOS affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiOS 7.6 affected >= 7.6.0, <= 7.6.7 fixed 7.6.8
- vendor:FortiOS 7.4 affected >= 7.4.0, <= 7.4.12 fixed 7.4.13
- vendor:FortiOS 7.2 affected >= 7.2.0, <= 7.2.13 fixed 7.2.14
- vendor:FortiOS 7.0 affected >= 7.0.1, <= 7.0.19 fixed no fixed version listed

## How to check

Run 'get system status' on each FortiGate (or see Dashboard) and compare the version: affected are 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13, 7.0.1-7.0.19. The flaw is in the OSPF daemon and the CVSS vector is adjacent-network (AV:A); check whether OSPF is configured ('show router ospf') and which interfaces carry it. Fortinet's page does not state whether OSPF must be enabled, so treat any affected version as exposed until you have upgraded.

## Fix

Upgrade FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 (or later). FortiOS 7.0 (7.0.1-7.0.19): migrate to a fixed release. FortiSASE 26.3.1 already remediated by Fortinet in 26.3.2; FortiSASE 25.x-26.2 migrate.

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126253
- 2026-11-11T22:32:20+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-267 — Read Fortinet PSIRT FG-IR-26-267: fixed versions and affected ranges confirmed; vendor page does not say OSPF must be enabled or give a workaround. Not exploited per vendor. Web search worked; X skipped.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-267: Authentication bypass by primary weakness https://fortiguard.fortinet.com/psirt/FG-IR-26-267

## From the sources

A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_