---
id: "CVE-2026-126258"
page: "https://infrastack.ai/live/CVE-2026-126258"
kind: "vulnerability"
aliases: ["CVE-2026-126258"]
title: "FortiOS: stack buffer overflow lets unauthenticated attackers crash proxy sessions"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiOS", "fixed": ["8.0.1"], "affected": "8.0.0", "ecosystem": "vendor"}, {"name": "FortiOS", "fixed": ["7.6.8"], "affected": "7.6.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firewall", "fortios", "infrastructure", "self-hosted", "wad", "ztna"]
not_affected_if: ["fortios-7.2", "fortios-7.4", "no-wad-port-access", "no-ztna-or-proxy"]
published_at: "2026-11-11T22:17:26+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:34:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126258", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-272", "first_seen_at": "2026-11-11T22:34:42+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-272", "https://www.rescana.com/post/fortinet-november-2026-psirt-fortimail-fortimanager-rce-patch-now"]}]
exploit_sources: []
---

# FortiOS: stack buffer overflow lets unauthenticated attackers crash proxy sessions

Link for people: https://infrastack.ai/live/CVE-2026-126258 (this .md is for agents)

A stack-based buffer overflow in FortiOS 8.0.0 and 7.6.7 can be triggered by crafted HTTP or HTTPS requests sent to the wad proxy service. The sources say it lets an unauthenticated attacker crash proxy or ZTNA sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiOS affected 8.0.0 fixed 8.0.1
- vendor:FortiOS affected 7.6.7 fixed 7.6.8

## How to check

- Run 'get system status' on the FortiGate: affected are FortiOS 8.0.0 and 7.6.7 only; 7.4 and 7.2 are not affected.
- Check whether the WAD proxy (explicit/transparent proxy, ZTNA) is enabled and whether its ports are reachable from untrusted networks; the advisory requires the attacker to have wad port access.

## Fix

FortiOS 8.0.0: upgrade to 8.0.1 or above. FortiOS 7.6.7: upgrade to 7.6.8 or above (Rescana reports Fortinet's CSAF file calls 7.6.8 'upcoming', so confirm it is released before planning). FortiOS 7.4 and 7.2 are not affected. No virtual patch. No workaround is listed in the advisory.

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126258
- 2026-11-11T22:34:42+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-272 — Read Fortinet PSIRT FG-IR-26-272 (via search snippet of fortiguard page): High, CVSS 7.1, unauth, not known exploited, fixes 8.0.1/7.6.8, no virtual patch. Fix not verified because CSAF reportedly says 7.6.8 upcoming (secondary source). X search not run.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-272: Stack buffer overflow in wad https://fortiguard.fortinet.com/psirt/FG-IR-26-272
- [mentions] Rescana: Fortinet November 2026 PSIRT https://www.rescana.com/post/fortinet-november-2026-psirt-fortimail-fortimanager-rce-patch-now

## From the sources

A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_