{"id":"CVE-2026-126254","kind":"vulnerability","aliases":["CVE-2026-126254"],"related":[],"title":"FortiOS: numeric truncation lets a BGP neighbor send malformed routes","description":"A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request","summary":"FortiOS, Fortinet's firewall and router operating system, mishandles numeric values in BGP attributes. A configured iBGP neighbor can send specially crafted malformed attributes that reach every router connected to it.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bgp","firewalls","fortinet","fortios","infrastructure","routers"],"not_affected_if":["fortios-outside-listed-ranges","no-bgp","no-ibgp-neighbors"],"how_to_check":"- Check the installed FortiOS version in the admin interface or with `get system status`\n- Check whether BGP is configured with `get router info bgp summary` and list the iBGP neighbors","fix":"- Move to a fixed FortiOS release listed in the Fortinet advisory; the sources do not name the fixed versions","status":"open","published_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:02+00:00","updated_at":"2026-11-11T22:31:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:31:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed FortiOS release listed in the Fortinet advisory; the sources do not name the fixed versions","reach":"network","title":"FortiOS: numeric truncation lets a BGP neighbor send malformed routes","impact":"high","summary":"FortiOS, Fortinet's firewall and router operating system, mishandles numeric values in BGP attributes. A configured iBGP neighbor can send specially crafted malformed attributes that reach every router connected to it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortios","fortinet","bgp","routers","firewalls"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"malformed routing attributes disrupt all connected routers","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126254 to confirm fixed versions and the impact on routing.","how_to_check":"- Check the installed FortiOS version in the admin interface or with `get system status`\n- Check whether BGP is configured with `get router info bgp summary` and list the iBGP neighbors","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-bgp","no-ibgp-neighbors","fortios-outside-listed-ranges"],"who_is_affected":"Only FortiOS devices that run BGP with an iBGP neighbor are exposed, and the attacker must already be a configured neighbor. Affected ranges are FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13. Networks without BGP, or without iBGP peers, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000788,"input_tokens":4615,"output_tokens":653,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126254':13A,16A '-2026':12A,15A '7.2.0':72C '7.2.13':74C '7.4.0':68C '7.4.12':70C '7.6.0':64C '7.6.7':66C '8.0.0':60C '8.0.1':62C 'allow':76C 'attribut':36B,46B,84C 'bgp':6A,17B,35B 'configur':38B,78C 'connect':51B,87C 'craft':44B,92C 'cve':11A,14A 'error':55C 'everi':49B 'firewal':18B,26B 'fortinet':19B,24B,58C 'fortio':1A,20B,23B,59C,63C,67C,71C 'ibgp':39B,79C 'infrastructur':21B 'let':4A 'malform':9A,45B 'malicious/malformed':83C 'may':75C 'mishandl':31B 'neighbor':7A,40B,80C 'numer':2A,32B,53C 'oper':29B 'reach':48B 'request':93C 'rout':10A 'router':22B,28B,50B,88C 'send':8A,42B,82C 'special':43B,91C 'system':30B 'truncat':3A,54C 'valu':33B 'via':89C 'vulner':56C","nicknames":[],"mitigations":[],"who_affected":"Only FortiOS devices that run BGP with an iBGP neighbor are exposed, and the attacker must already be a configured neighbor. Affected ranges are FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13. Networks without BGP, or without iBGP peers, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bgp","critical","firewalls","fortinet","fortios","infrastructure","routers"],"campaign_type":null,"search_a":"'-126254':13A,16A '-2026':12A,15A 'bgp':6A 'cve':11A,14A 'fortio':1A 'let':4A 'malform':9A 'neighbor':7A 'numer':2A 'rout':10A 'send':8A 'truncat':3A","search_b":"'attribut':36B,46B 'bgp':17B,35B 'configur':38B 'connect':51B 'craft':44B 'everi':49B 'firewal':18B,26B 'fortinet':19B,24B 'fortio':20B,23B 'ibgp':39B 'infrastructur':21B 'malform':45B 'mishandl':31B 'neighbor':40B 'numer':32B 'oper':29B 'reach':48B 'router':22B,28B,50B 'send':42B 'special':43B 'system':30B 'valu':33B","search_c":"'7.2.0':72C '7.2.13':74C '7.4.0':68C '7.4.12':70C '7.6.0':64C '7.6.7':66C '8.0.0':60C '8.0.1':62C 'allow':76C 'attribut':84C 'configur':78C 'connect':87C 'craft':92C 'error':55C 'fortinet':58C 'fortio':59C,63C,67C,71C 'ibgp':79C 'malicious/malformed':83C 'may':75C 'neighbor':80C 'numer':53C 'request':93C 'router':88C 'send':82C 'special':91C 'truncat':54C 'via':89C 'vulner':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126254","severity":null,"published_at":"2026-11-11T22:17:25+00:00","modified_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}