FORTIOS · CVE-2026-126255 · Vendor
FIX → 8.0.2 · 7.6.8 · 1.7 +2 ✓ verified
Fortinet FG-IR-26-269 (CVE-2026-126255, High, CVSS 7.4): a path traversal flaw in the ssh daemon of FortiOS and FortiPAM may let an unauthenticated attacker bypass authentication with specially crafted credentials. Fortinet says the product is impacted only if GPC OS Login is enabled. Not known exploited per the vendor. The advisory text also names FortiSASE and FortiProxy; FortiSASE 26.3.x was remediated by Fortinet, older FortiSASE needs migration.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running FortiOS or FortiPAM firmware in the listed version ranges, especially appliances with administrative or VPN interfaces exposed to untrusted networks. The sources do not say which features or configurations are required, so assume any listed version is exposed until the vendor advisory is checked.
Not affected if gpc-os-login-disabled, unknown
Who cares firewall, fortinet-appliance, fortios, fortipam, gpc-os-login, ssh
7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, ; FortiPAM 1.0-1.6 all versions)A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.0.0-8.0.1Upgrade to 8.0.2 · 7.6.8 · 1.7 +2
7.2.14, 7.4.13, 7.6.8 or 8.0.2 or above26.3.1: Fortinet remediated in 26.3.2, no action needed