{"id":"CVE-2026-126258","kind":"vulnerability","aliases":["CVE-2026-126258"],"related":[],"title":"FortiOS: stack buffer overflow lets unauthenticated attackers crash proxy sessions","description":"A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests.","summary":"A stack-based buffer overflow in FortiOS 8.0.0 and 7.6.7 can be triggered by crafted HTTP or HTTPS requests sent to the wad proxy service. The sources say it lets an unauthenticated attacker crash proxy or ZTNA sessions.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiOS","fixed":["8.0.1"],"affected":"8.0.0","ecosystem":"vendor"},{"name":"FortiOS","fixed":["7.6.8"],"affected":"7.6.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["firewall","fortios","infrastructure","self-hosted","wad","ztna"],"not_affected_if":["fortios-7.2","fortios-7.4","no-wad-port-access","no-ztna-or-proxy"],"how_to_check":"- Run 'get system status' on the FortiGate: affected are FortiOS 8.0.0 and 7.6.7 only; 7.4 and 7.2 are not affected.\n- Check whether the WAD proxy (explicit/transparent proxy, ZTNA) is enabled and whether its ports are reachable from untrusted networks; the advisory requires the attacker to have wad port access.","fix":"FortiOS 8.0.0: upgrade to 8.0.1 or above. FortiOS 7.6.7: upgrade to 7.6.8 or above (Rescana reports Fortinet's CSAF file calls 7.6.8 'upcoming', so confirm it is released before planning). FortiOS 7.4 and 7.2 are not affected. No virtual patch. No workaround is listed in the advisory.","status":"open","published_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:58+00:00","updated_at":"2026-11-11T22:34:42+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FortiOS: stack buffer overflow lets unauthenticated attackers crash proxy sessions","impact":"low","summary":"A stack-based buffer overflow in FortiOS 8.0.0 and 7.6.7 can be triggered by crafted HTTP or HTTPS requests sent to the wad proxy service. The sources say it lets an unauthenticated attacker crash proxy or ZTNA sessions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortios","ztna","firewall"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker crashes proxy or ZTNA sessions on the appliance","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126258 to confirm the fixed FortiOS versions and any workaround.","how_to_check":"- Confirm the running FortiOS version with `get system status` on the appliance.\n- Check whether the wad proxy or ZTNA features are enabled and reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ztna-or-proxy","no-wad-port-access"],"who_is_affected":"FortiOS 8.0.0 and 7.6.7 devices where the wad proxy or ZTNA sessions accept HTTP or HTTPS traffic from an attacker with access to the wad port. Devices with no proxy or ZTNA exposure are likely not affected, but the sources do not state this explicitly.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4568,"output_tokens":606,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126258 to confirm the fixed FortiOS versions and any workaround.","search":"'-126258':13A,16A '-2026':12A,15A '7.6.7':37B,78C '8.0.0':35B,76C 'access':87C 'allow':80C 'attack':7A,60B,83C 'base':30B,69C 'buffer':3A,31B,70C 'craft':42B,95C 'crash':8A,61B,89C 'cve':11A,14A 'firewal':19B 'fortinet':74C 'fortio':1A,20B,34B,75C,77C 'fortios':17A,18A 'host':24B 'http':43B,96C 'https':45B,98C 'infrastructur':21B 'let':5A,57B 'may':79C 'overflow':4A,32B,71C 'port':86C 'proxi':9A,51B,62B,90C 'request':46B,99C 'say':55B 'self':23B 'self-host':22B 'sent':47B 'servic':52B 'session':10A,65B,93C 'sourc':54B 'stack':2A,29B,68C 'stack-bas':28B,67C 'trigger':40B 'unauthent':6A,59B,82C 'via':94C 'vulner':72C 'wad':25B,50B,85C 'ztna':26B,64B,92C","nicknames":[],"mitigations":[],"who_affected":"FortiGate/FortiOS devices running 8.0.0 or 7.6.7 where the wad proxy service (web proxy, ZTNA) is reachable by an attacker, with no login needed. Fortinet says crafted HTTP/HTTPS requests can crash proxy or ZTNA sessions; its Impact field also says 'execute unauthorized code or commands'. FortiOS 7.4 and 7.2 are not affected. Devices not exposing wad ports to untrusted networks have less exposure.","tier":"B","verified":{"products":{"at":"2026-11-11T22:34:42Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-272","run_id":3611},"who_affected":{"at":"2026-11-11T22:34:42Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-272","run_id":3611}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortios"],"ptokens":["fortios"],"labels":["firewall","fortios","high","infrastructure","selfhosted","wad","ztna"],"campaign_type":null,"search_a":"'-126258':13A,16A '-2026':12A,15A 'attack':7A 'buffer':3A 'crash':8A 'cve':11A,14A 'fortio':1A 'fortios':17A,18A 'let':5A 'overflow':4A 'proxi':9A 'session':10A 'stack':2A 'unauthent':6A","search_b":"'7.6.7':37B '8.0.0':35B 'attack':60B 'base':30B 'buffer':31B 'craft':42B 'crash':61B 'firewal':19B 'fortio':20B,34B 'host':24B 'http':43B 'https':45B 'infrastructur':21B 'let':57B 'overflow':32B 'proxi':51B,62B 'request':46B 'say':55B 'self':23B 'self-host':22B 'sent':47B 'servic':52B 'session':65B 'sourc':54B 'stack':29B 'stack-bas':28B 'trigger':40B 'unauthent':59B 'wad':25B,50B 'ztna':26B,64B","search_c":"'7.6.7':78C '8.0.0':76C 'access':87C 'allow':80C 'attack':83C 'base':69C 'buffer':70C 'craft':95C 'crash':89C 'fortinet':74C 'fortio':75C,77C 'http':96C 'https':98C 'may':79C 'overflow':71C 'port':86C 'proxi':90C 'request':99C 'session':93C 'stack':68C 'stack-bas':67C 'unauthent':82C 'via':94C 'vulner':72C 'wad':85C 'ztna':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126258","severity":null,"published_at":"2026-11-11T22:17:26+00:00","modified_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126258:3611","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-272","severity":null,"published_at":"2026-11-11T22:34:42+00:00","modified_at":"2026-11-11T22:34:42+00:00","first_seen_at":"2026-11-11T22:34:42+00:00","fetched_at":"2026-11-11T22:34:42+00:00","note":"Read Fortinet PSIRT FG-IR-26-272 (via search snippet of fortiguard page): High, CVSS 7.1, unauth, not known exploited, fixes 8.0.1/7.6.8, no virtual patch. Fix not verified because CSAF reportedly says 7.6.8 upcoming (secondary source). X search not run.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-272","https://www.rescana.com/post/fortinet-november-2026-psirt-fortimail-fortimanager-rce-patch-now"]}],"documents":[{"id":129654,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-272","title":"Fortinet PSIRT FG-IR-26-272: Stack buffer overflow in wad","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129655,"url":"https://www.rescana.com/post/fortinet-november-2026-psirt-fortimail-fortimanager-rce-patch-now","title":"Rescana: Fortinet November 2026 PSIRT","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}