---
id: "CVE-2026-126255"
page: "https://infrastack.ai/live/CVE-2026-126255"
kind: "vulnerability"
aliases: ["CVE-2026-126255"]
title: "FortiOS and FortiPAM SSH daemon: path traversal lets unauthenticated attackers bypass login when GPC OS Login is enabled"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiOS", "fixed": ["7.2.14", "7.4.13", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.13; >= 7.4.0, <= 7.4.12; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiPAM", "fixed": ["1.7"], "affected": ">= 1.0, <= 1.6 all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firewall", "fortinet-appliance", "fortios", "fortipam", "gpc-os-login", "ssh", "vendor"]
not_affected_if: ["gpc-os-login-disabled", "unknown"]
published_at: "2026-11-11T22:17:25+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:34:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126255", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-269", "first_seen_at": "2026-11-11T22:34:36+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-269"]}]
exploit_sources: []
---

# FortiOS and FortiPAM SSH daemon: path traversal lets unauthenticated attackers bypass login when GPC OS Login is enabled

Link for people: https://infrastack.ai/live/CVE-2026-126255 (this .md is for agents)

Fortinet FG-IR-26-269 (CVE-2026-126255, High, CVSS 7.4): a path traversal flaw in the ssh daemon of FortiOS and FortiPAM may let an unauthenticated attacker bypass authentication with specially crafted credentials. Fortinet says the product is impacted only if GPC OS Login is enabled. Not known exploited per the vendor. The advisory text also names FortiSASE and FortiProxy; FortiSASE 26.3.x was remediated by Fortinet, older FortiSASE needs migration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiOS affected >= 7.2.0, <= 7.2.13; >= 7.4.0, <= 7.4.12; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.14, 7.4.13, 7.6.8, 8.0.2
- vendor:FortiPAM affected >= 1.0, <= 1.6 all versions fixed 1.7

## How to check

Check the FortiOS/FortiPAM version against the affected ranges (FortiOS 7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, 8.0.0-8.0.1; FortiPAM 1.0-1.6 all versions). Then check whether GPC OS Login is enabled in the device configuration; Fortinet says only devices with it enabled are impacted. Also check FortiProxy, which the advisory summary names but its table does not list, and FortiSASE (25.1 to 26.2 need migration).

## Fix

FortiOS: upgrade to 7.2.14, 7.4.13, 7.6.8 or 8.0.2 or above. FortiPAM 1.0-1.6: migrate to a fixed release (1.7 and later are not affected). FortiSASE 26.3.1: Fortinet remediated in 26.3.2, no action needed.

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126255
- 2026-11-11T22:34:36+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-269 — Read Fortinet FG-IR-26-269: affected only if GPC OS Login enabled; fixed versions per table; not exploited per vendor; no workaround stated. No repo-readable check (device setting). Social not searched.

## Documents

- [advisory] Fortinet FG-IR-26-269 (sshd path traversal auth bypass) https://fortiguard.fortinet.com/psirt/FG-IR-26-269

## From the sources

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_