FORTIOS · CVE-2026-126259 · Infrastructure
FIX → 8.0.1 · 7.6.8 +2 ✓ verified
A missing authentication check in FortiOS high-availability packet handling lets an unauthenticated attacker send crafted HA packets and execute commands with super admin rights. The flaw applies only to systems using HA FGSP with standalone-config-sync or autoscale.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
FortiOS devices (FortiGate firewalls) running an affected version that use HA FGSP with standalone-config-sync, or autoscale. Fortinet describes the attacker as adjacent and unauthenticated, sending crafted HA packets to get super admin command execution. Teams without FGSP config sync or autoscale are outside the stated condition.
Not affected if default-config, no-autoscale, no-fgsp-config-sync, no-fgsp-or-autoscale
Who cares autoscale, fgsp, firewall, fortigate, fortinet, fortios, high-availability
get system status on the FortiGate and compare the version with: 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13, any 7.0A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.1 · 7.6.8 +2