{"id":"CVE-2026-126255","kind":"vulnerability","aliases":["CVE-2026-126255"],"related":[],"title":"FortiOS and FortiPAM SSH daemon: path traversal lets unauthenticated attackers bypass login when GPC OS Login is enabled","description":"A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.","summary":"Fortinet FG-IR-26-269 (CVE-2026-126255, High, CVSS 7.4): a path traversal flaw in the ssh daemon of FortiOS and FortiPAM may let an unauthenticated attacker bypass authentication with specially crafted credentials. Fortinet says the product is impacted only if GPC OS Login is enabled. Not known exploited per the vendor. The advisory text also names FortiSASE and FortiProxy; FortiSASE 26.3.x was remediated by Fortinet, older FortiSASE needs migration.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiOS","fixed":["7.2.14","7.4.13","7.6.8","8.0.2"],"affected":">= 7.2.0, <= 7.2.13; >= 7.4.0, <= 7.4.12; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiPAM","fixed":["1.7"],"affected":">= 1.0, <= 1.6 all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["firewall","fortinet-appliance","fortios","fortipam","gpc-os-login","ssh","vendor"],"not_affected_if":["gpc-os-login-disabled","unknown"],"how_to_check":"Check the FortiOS/FortiPAM version against the affected ranges (FortiOS 7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, 8.0.0-8.0.1; FortiPAM 1.0-1.6 all versions). Then check whether GPC OS Login is enabled in the device configuration; Fortinet says only devices with it enabled are impacted. Also check FortiProxy, which the advisory summary names but its table does not list, and FortiSASE (25.1 to 26.2 need migration).","fix":"FortiOS: upgrade to 7.2.14, 7.4.13, 7.6.8 or 8.0.2 or above. FortiPAM 1.0-1.6: migrate to a fixed release (1.7 and later are not affected). FortiSASE 26.3.1: Fortinet remediated in 26.3.2, no action needed.","status":"open","published_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:33:11+00:00","updated_at":"2026-11-11T22:34:36+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:33:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiOS and FortiPAM: path traversal lets unauthenticated attackers bypass login","impact":"high","summary":"A path traversal flaw in FortiOS and FortiPAM lets an unauthenticated attacker bypass authentication using specially crafted credentials. The NVD record rates it high (CVSS 7.4).","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortios","fortipam","fortinet-appliance","firewall"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker bypasses authentication and gains access to the appliance","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions, exposed features and any workaround; the NVD entry does not state them.","how_to_check":"- Check the installed FortiOS or FortiPAM version against the affected ranges listed in the description (FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13; all FortiPAM 1.0 to 1.6 versions)\n- Confirm whether the management or SSL VPN interface is reachable from the internet\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running FortiOS or FortiPAM firmware in the listed version ranges, especially appliances with administrative or VPN interfaces exposed to untrusted networks. The sources do not say which features or configurations are required, so assume any listed version is exposed until the vendor advisory is checked.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4716,"output_tokens":641,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions, exposed features and any workaround; the NVD entry does not state them.","search":"'-126255':21A,24A,47B '-2026':20A,23A,46B '-269':44B '/filedir':115C '1.0':160C '1.1':156C '1.2':152C '1.3':148C '1.4':144C '1.5':140C '1.6':136C '26':43B '26.3':102B '7.2.0':132C '7.2.13':134C '7.4':50B '7.4.0':128C '7.4.12':130C '7.6.0':124C '7.6.7':126C '8.0.0':120C '8.0.1':122C 'advisori':94B 'allow':164C 'also':96B 'applianc':30B 'attack':10A,67B,167C 'authent':69B,170C 'bypass':11A,68B,169C 'craft':72B,173C 'credenti':73B,174C 'cve':19A,22A,45B 'cvss':49B 'daemon':5A,58B 'enabl':18A,86B 'exploit':89B 'fg':41B 'fg-ir':40B 'firewal':27B 'flaw':54B 'fortinet':29B,39B,74B,107B,118C 'fortinet-appli':28B 'fortio':1A,31B,60B,119C,123C,127C,131C 'fortios':25A 'fortipam':3A,26A,32B,62B,135C,139C,143C,147C,151C,155C,159C 'fortiproxi':100B 'fortisas':98B,101B,109B 'gpc':14A,34B,82B 'gpc-os-login':33B 'high':48B 'impact':79B 'ir':42B 'known':88B 'let':8A,64B 'login':12A,16A,36B,84B 'may':63B,163C 'migrat':111B 'name':97B 'need':110B 'older':108B 'os':15A,35B,83B 'path':6A,52B,113C 'per':90B 'product':77B 'remedi':105B 'say':75B 'special':71B,172C 'ssh':4A,37B,57B 'text':95B 'travers':7A,53B,114C 'unauthent':9A,66B,166C 'vendor':38B,92B 'version':138C,142C,146C,150C,154C,158C,162C 'via':171C 'vulner':116C 'x':103B","nicknames":[],"mitigations":[],"who_affected":"Organisations running FortiOS or FortiPAM firmware in the listed version ranges, especially appliances with administrative or VPN interfaces exposed to untrusted networks. The sources do not say which features or configurations are required, so assume any listed version is exposed until the vendor advisory is checked.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:34:36Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269","run_id":3613},"how_to_check":{"at":"2026-11-11T22:34:36Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269","run_id":3613},"who_affected":{"at":"2026-11-11T22:34:36Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269","run_id":3613}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortios","fortipam"],"ptokens":["fortios","fortipam"],"labels":["firewall","fortinetappliance","fortios","fortipam","gpcoslogin","high","ssh","vendor"],"campaign_type":null,"search_a":"'-126255':21A,24A '-2026':20A,23A 'attack':10A 'bypass':11A 'cve':19A,22A 'daemon':5A 'enabl':18A 'fortio':1A 'fortios':25A 'fortipam':3A,26A 'gpc':14A 'let':8A 'login':12A,16A 'os':15A 'path':6A 'ssh':4A 'travers':7A 'unauthent':9A","search_b":"'-126255':47B '-2026':46B '-269':44B '26':43B '26.3':102B '7.4':50B 'advisori':94B 'also':96B 'applianc':30B 'attack':67B 'authent':69B 'bypass':68B 'craft':72B 'credenti':73B 'cve':45B 'cvss':49B 'daemon':58B 'enabl':86B 'exploit':89B 'fg':41B 'fg-ir':40B 'firewal':27B 'flaw':54B 'fortinet':29B,39B,74B,107B 'fortinet-appli':28B 'fortio':31B,60B 'fortipam':32B,62B 'fortiproxi':100B 'fortisas':98B,101B,109B 'gpc':34B,82B 'gpc-os-login':33B 'high':48B 'impact':79B 'ir':42B 'known':88B 'let':64B 'login':36B,84B 'may':63B 'migrat':111B 'name':97B 'need':110B 'older':108B 'os':35B,83B 'path':52B 'per':90B 'product':77B 'remedi':105B 'say':75B 'special':71B 'ssh':37B,57B 'text':95B 'travers':53B 'unauthent':66B 'vendor':38B,92B 'x':103B","search_c":"'/filedir':115C '1.0':160C '1.1':156C '1.2':152C '1.3':148C '1.4':144C '1.5':140C '1.6':136C '7.2.0':132C '7.2.13':134C '7.4.0':128C '7.4.12':130C '7.6.0':124C '7.6.7':126C '8.0.0':120C '8.0.1':122C 'allow':164C 'attack':167C 'authent':170C 'bypass':169C 'craft':173C 'credenti':174C 'fortinet':118C 'fortio':119C,123C,127C,131C 'fortipam':135C,139C,143C,147C,151C,155C,159C 'may':163C 'path':113C 'special':172C 'travers':114C 'unauthent':166C 'version':138C,142C,146C,150C,154C,158C,162C 'via':171C 'vulner':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126255","severity":null,"published_at":"2026-11-11T22:17:25+00:00","modified_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126255:3613","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269","severity":null,"published_at":"2026-11-11T22:34:36+00:00","modified_at":"2026-11-11T22:34:36+00:00","first_seen_at":"2026-11-11T22:34:36+00:00","fetched_at":"2026-11-11T22:34:36+00:00","note":"Read Fortinet FG-IR-26-269: affected only if GPC OS Login enabled; fixed versions per table; not exploited per vendor; no workaround stated. No repo-readable check (device setting). Social not searched.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-269"]}],"documents":[{"id":129653,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269","title":"Fortinet FG-IR-26-269 (sshd path traversal auth bypass)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}