---
id: "CVE-2026-126256"
page: "https://infrastack.ai/live/CVE-2026-126256"
kind: "vulnerability"
aliases: ["CVE-2026-126256"]
title: "FortiOS kernel out-of-bounds read/write lets a remote attacker run code via crafted packets"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiOS", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiOS 7.6", "fixed": ["7.6.8"], "affected": ">= 7.6.0, <= 7.6.7", "ecosystem": "vendor"}, {"name": "FortiOS 7.4", "fixed": ["7.4.13"], "affected": ">= 7.4.0, <= 7.4.12", "ecosystem": "vendor"}, {"name": "FortiOS 7.2", "fixed": ["7.2.14"], "affected": ">= 7.2.0, <= 7.2.13", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firewall", "fortinet", "fortios", "fortisase", "infrastructure", "kernel"]
not_affected_if: ["unknown"]
published_at: "2026-11-11T22:17:25+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:34:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126256", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-270", "first_seen_at": "2026-11-11T22:34:37+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-270", "https://www.tenable.com/plugins/nessus/378652"]}]
exploit_sources: []
---

# FortiOS kernel out-of-bounds read/write lets a remote attacker run code via crafted packets

Link for people: https://infrastack.ai/live/CVE-2026-126256 (this .md is for agents)

Fortinet's advisory FG-IR-26-270 describes an out-of-bounds read/write (CWE-125/CWE-787) in the FortiOS kernel, also affecting FortiSASE. Crafted packets may let a remote attacker execute code or commands. Fortinet rates it High (CVSS 7.4), says it was found internally, and lists it as not known to be exploited. Fixed in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiOS affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiOS 7.6 affected >= 7.6.0, <= 7.6.7 fixed 7.6.8
- vendor:FortiOS 7.4 affected >= 7.4.0, <= 7.4.12 fixed 7.4.13
- vendor:FortiOS 7.2 affected >= 7.2.0, <= 7.2.13 fixed 7.2.14

## How to check

Run 'get system status' on each FortiGate and compare to the affected ranges: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13. NVD also lists FortiOS 7.0 (all versions) but Fortinet's advisory table has no 7.0 row, so 7.0 devices should move to a fixed branch regardless. FortiSASE is Fortinet-managed: 26.3.x was remediated in 26.3.2 with no customer action; older FortiSASE branches should migrate to a fixed release.

## Fix

Upgrade FortiOS to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later; use Fortinet's upgrade path tool https://docs.fortinet.com/upgrade-tool. Fortinet also offers a virtual patch (FG-VD-62355.0day) in FMWP db update 26.100.

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126256
- 2026-11-11T22:34:37+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-270 — Read Fortinet PSIRT FG-IR-26-270: fixed 8.0.2, 7.6.8, 7.4.13, 7.2.14; no exploitation; virtual patch FG-VD-62355.0day in FMWP db 26.100. NVD says 7.0 all versions, vendor table has no 7.0 row. X/community not searched (low-signal for B).

## Documents

- [advisory] FortiGuard PSIRT FG-IR-26-270: Out-of-bounds read in kernel https://www.fortiguard.com/psirt/FG-IR-26-270
- [mentions] Tenable plugin 378652 FG-IR-26-270 https://www.tenable.com/plugins/nessus/378652

## From the sources

A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_