{"id":"CVE-2026-126256","kind":"vulnerability","aliases":["CVE-2026-126256"],"related":[],"title":"FortiOS kernel out-of-bounds read/write lets a remote attacker run code via crafted packets","description":"A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets.","summary":"Fortinet's advisory FG-IR-26-270 describes an out-of-bounds read/write (CWE-125/CWE-787) in the FortiOS kernel, also affecting FortiSASE. Crafted packets may let a remote attacker execute code or commands. Fortinet rates it High (CVSS 7.4), says it was found internally, and lists it as not known to be exploited. Fixed in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiOS","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiOS 7.6","fixed":["7.6.8"],"affected":">= 7.6.0, <= 7.6.7","ecosystem":"vendor"},{"name":"FortiOS 7.4","fixed":["7.4.13"],"affected":">= 7.4.0, <= 7.4.12","ecosystem":"vendor"},{"name":"FortiOS 7.2","fixed":["7.2.14"],"affected":">= 7.2.0, <= 7.2.13","ecosystem":"vendor"}],"ecosystems":[],"tags":["firewall","fortinet","fortios","fortisase","infrastructure","kernel"],"not_affected_if":["unknown"],"how_to_check":"Run 'get system status' on each FortiGate and compare to the affected ranges: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13. NVD also lists FortiOS 7.0 (all versions) but Fortinet's advisory table has no 7.0 row, so 7.0 devices should move to a fixed branch regardless. FortiSASE is Fortinet-managed: 26.3.x was remediated in 26.3.2 with no customer action; older FortiSASE branches should migrate to a fixed release.","fix":"Upgrade FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later; use Fortinet's upgrade path tool https://docs.fortinet.com/upgrade-tool. Fortinet also offers a virtual patch (FG-VD-62355.0day) in FMWP db update 26.100.","status":"open","published_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:33:09+00:00","updated_at":"2026-11-11T22:34:37+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:33:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiOS: out-of-bounds read lets a remote attacker run code","impact":"high","summary":"An out-of-bounds read in FortiOS, Fortinet's firewall operating system, can be triggered by crafted packets. The description says a remote attacker with privileges may execute arbitrary code or commands.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortios","firewall","fortinet"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker runs arbitrary code on the firewall","analyst_note":"Confirm the fixed FortiOS versions and any workaround in Fortinet's PSIRT advisory; the NVD entry alone gives no fix.","how_to_check":"- Check the FortiOS version on the device, for example with `get system status`, and compare it with the affected ranges: `8.0.0` to `8.0.1`, `7.6.0` to `7.6.7`, and all `7.4`, `7.2` and `7.0` releases.\n- unknown for any further check; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running FortiOS firewalls in the affected version ranges, including all 7.4, 7.2 and 7.0 releases according to the description. Exposure is greatest where the device handles traffic from untrusted networks. The sources do not say which configurations are required to reach the flaw.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4617,"output_tokens":571,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FortiOS versions and any workaround in Fortinet's PSIRT advisory; the NVD entry alone gives no fix.","search":"'-125':52B '-126256':19A,22A '-2026':18A,21A '-270':43B '/cwe-787':53B '26':42B '7.0':126C '7.2':29A,122C '7.2.14':99B '7.4':27A,77B,118C '7.4.13':97B '7.6':25A '7.6.0':114C '7.6.7':116C '7.6.8':96B '8.0.0':110C '8.0.1':112C '8.0.2':95B 'advisori':38B 'affect':59B 'allow':130C 'also':58B 'arbitrari':137C 'attack':11A,67B,134C 'bound':6A,49B,104C 'code':13A,69B,138C 'command':71B,140C 'craft':15A,61B,142C 'cve':17A,20A 'cvss':76B 'cwe':51B 'describ':44B 'execut':68B,136C 'exploit':91B 'fg':40B 'fg-ir':39B 'firewal':30B 'fix':92B 'fortinet':31B,36B,72B,108C 'fortio':1A,32B,56B,94B,109C,113C,117C,121C,125C 'fortios':23A,24A,26A,28A 'fortisas':33B,60B 'found':81B 'high':75B 'infrastructur':34B 'intern':82B 'ir':41B 'kernel':2A,35B,57B 'known':88B 'let':8A,64B 'list':84B 'may':63B,129C 'out-of-bound':3A,46B,101C 'packet':16A,62B 'paquet':143C 'privileg':133C 'rate':73B 'read':105C 'read/write':7A,50B 'remot':10A,66B,132C 'run':12A 'say':78B 'version':120C,124C,128C 'via':14A,141C 'vulner':106C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiGate firewalls on FortiOS 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12 or 7.2.0-7.2.13, and FortiSASE customers on older branches. Fortinet classes the attack as unauthenticated over crafted packets, although the description says 'privileged'. Anyone on a fixed version can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:34:37Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-270","run_id":3612},"products":{"at":"2026-11-11T22:34:37Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-270","run_id":3612},"how_to_check":{"at":"2026-11-11T22:34:37Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-270","run_id":3612},"who_affected":{"at":"2026-11-11T22:34:37Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-270","run_id":3612}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["72","74","76","fortios","fortios72","fortios74","fortios76"],"ptokens":["fortios"],"labels":["firewall","fortinet","fortios","fortisase","high","infrastructure","kernel"],"campaign_type":null,"search_a":"'-126256':19A,22A '-2026':18A,21A '7.2':29A '7.4':27A '7.6':25A 'attack':11A 'bound':6A 'code':13A 'craft':15A 'cve':17A,20A 'fortio':1A 'fortios':23A,24A,26A,28A 'kernel':2A 'let':8A 'out-of-bound':3A 'packet':16A 'read/write':7A 'remot':10A 'run':12A 'via':14A","search_b":"'-125':52B '-270':43B '/cwe-787':53B '26':42B '7.2.14':99B '7.4':77B '7.4.13':97B '7.6.8':96B '8.0.2':95B 'advisori':38B 'affect':59B 'also':58B 'attack':67B 'bound':49B 'code':69B 'command':71B 'craft':61B 'cvss':76B 'cwe':51B 'describ':44B 'execut':68B 'exploit':91B 'fg':40B 'fg-ir':39B 'firewal':30B 'fix':92B 'fortinet':31B,36B,72B 'fortio':32B,56B,94B 'fortisas':33B,60B 'found':81B 'high':75B 'infrastructur':34B 'intern':82B 'ir':41B 'kernel':35B,57B 'known':88B 'let':64B 'list':84B 'may':63B 'out-of-bound':46B 'packet':62B 'rate':73B 'read/write':50B 'remot':66B 'say':78B","search_c":"'7.0':126C '7.2':122C '7.4':118C '7.6.0':114C '7.6.7':116C '8.0.0':110C '8.0.1':112C 'allow':130C 'arbitrari':137C 'attack':134C 'bound':104C 'code':138C 'command':140C 'craft':142C 'execut':136C 'fortinet':108C 'fortio':109C,113C,117C,121C,125C 'may':129C 'out-of-bound':101C 'paquet':143C 'privileg':133C 'read':105C 'remot':132C 'version':120C,124C,128C 'via':141C 'vulner':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126256","severity":null,"published_at":"2026-11-11T22:17:25+00:00","modified_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126256:3612","url":"https://www.fortiguard.com/psirt/FG-IR-26-270","severity":null,"published_at":"2026-11-11T22:34:37+00:00","modified_at":"2026-11-11T22:34:37+00:00","first_seen_at":"2026-11-11T22:34:37+00:00","fetched_at":"2026-11-11T22:34:37+00:00","note":"Read Fortinet PSIRT FG-IR-26-270: fixed 8.0.2, 7.6.8, 7.4.13, 7.2.14; no exploitation; virtual patch FG-VD-62355.0day in FMWP db 26.100. NVD says 7.0 all versions, vendor table has no 7.0 row. X/community not searched (low-signal for B).","cites":["https://www.fortiguard.com/psirt/FG-IR-26-270","https://www.tenable.com/plugins/nessus/378652"]}],"documents":[{"id":129649,"url":"https://www.fortiguard.com/psirt/FG-IR-26-270","title":"FortiGuard PSIRT FG-IR-26-270: Out-of-bounds read in kernel","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129650,"url":"https://www.tenable.com/plugins/nessus/378652","title":"Tenable plugin 378652 FG-IR-26-270","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}