{"id":"CVE-2026-126259","kind":"vulnerability","aliases":["CVE-2026-126259"],"related":[],"title":"FortiOS: missing authentication lets unauthenticated attackers run commands as admin","description":"A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.","summary":"A missing authentication check in FortiOS high-availability packet handling lets an unauthenticated attacker send crafted HA packets and execute commands with super admin rights. The flaw applies only to systems using HA FGSP with standalone-config-sync or autoscale.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiOS","fixed":["8.0.1","7.6.8","7.4.13","7.2.14"],"affected":"8.0.0; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.12; >= 7.2.0, <= 7.2.13; 7.0 all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["autoscale","fgsp","firewall","fortigate","fortinet","fortios","high-availability","infrastructure"],"not_affected_if":["default-config","no-autoscale","no-fgsp-config-sync","no-fgsp-or-autoscale"],"how_to_check":"Run 'get system status' on the FortiGate and compare the version with: 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13, any 7.0. Then check the config for HA FGSP with standalone-config-sync enabled, or an autoscale setup. Devices without those are outside the stated condition, but upgrade anyway.","fix":"Upgrade FortiOS 8.0 to 8.0.1+, 7.6 to 7.6.8+, 7.4 to 7.4.13+, 7.2 to 7.2.14+. FortiOS 7.0 (all versions) has no fix in branch: migrate to a fixed release. Upgrade path tool: https://docs.fortinet.com/upgrade-tool. Interim: Fortinet IPS virtual patch FG-VD-61445.0day in FMWP db update 26.082.","status":"open","published_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:30:56+00:00","updated_at":"2026-11-11T22:32:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:30:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FortiOS: missing authentication lets unauthenticated attackers run commands as admin","impact":"high","summary":"A missing authentication check in FortiOS high-availability packet handling lets an unauthenticated attacker send crafted HA packets and execute commands with super admin rights. The flaw applies only to systems using HA FGSP with standalone-config-sync or autoscale.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortios","fortinet","firewall","high-availability"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker executes commands as super admin on the firewall","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126259 to confirm fixed versions and the exact HA conditions.","how_to_check":"- Confirm the FortiOS version against the affected ranges: `8.0.0`, `7.6.0` through `7.6.7`, `7.4.0` through `7.4.12`, `7.2.0` through `7.2.13`\n- Check whether HA FGSP with standalone-config-sync or autoscale is enabled on the device\n- unknown whether the sources describe a further check","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-fgsp-or-autoscale"],"who_is_affected":"Only FortiOS devices in the listed version ranges that run HA FGSP with standalone-config-sync or autoscale are described as exposed. Devices outside those versions or without those HA features are not described as affected. The sources do not name a fixed release.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000774,"input_tokens":4615,"output_tokens":624,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126259 to confirm fixed versions and the exact HA conditions.","search":"'-126259':13A,16A '-2026':12A,15A '7.2.0':90C '7.2.13':92C '7.4.0':86C '7.4.12':88C '7.6.0':82C '7.6.7':84C '8.0.0':80C 'admin':10A,52B,112C 'allow':94C 'appli':56B 'attack':6A,42B,97C 'authent':3A,30B,72C 'autoscal':18B,69B,106C 'avail':26B,36B 'check':31B 'command':8A,49B,109C 'config':66B,103C 'craft':44B,114C 'critic':74C 'cve':11A,14A 'execut':48B,108C 'fgsp':19B,62B,100C 'firewal':20B 'flaw':55B 'fortig':21B 'fortinet':22B,78C 'fortio':1A,23B,33B,79C,81C,85C,89C 'fortios':17A 'function':75C 'ha':45B,61B,99C,115C 'handl':38B 'high':25B,35B 'high-avail':24B,34B 'infrastructur':27B 'let':4A,39B 'may':93C 'miss':2A,29B,71C 'packet':37B,46B,116C 'right':53B 'run':7A 'send':43B 'standalon':65B,102C 'standalone-config-sync':64B,101C 'super':51B,111C 'sync':67B,104C 'system':59B 'unauthent':5A,41B,96C 'use':60B 'via':113C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"FortiOS devices (FortiGate firewalls) running an affected version that use HA FGSP with standalone-config-sync, or autoscale. Fortinet describes the attacker as adjacent and unauthenticated, sending crafted HA packets to get super admin command execution. Teams without FGSP config sync or autoscale are outside the stated condition.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:32:28Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273","run_id":3602},"products":{"at":"2026-11-11T22:32:28Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273","run_id":3602},"how_to_check":{"at":"2026-11-11T22:32:28Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273","run_id":3602},"who_affected":{"at":"2026-11-11T22:32:28Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273","run_id":3602}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fortios"],"ptokens":["fortios"],"labels":["autoscale","critical","fgsp","firewall","fortigate","fortinet","fortios","highavailability","infrastructure"],"campaign_type":null,"search_a":"'-126259':13A,16A '-2026':12A,15A 'admin':10A 'attack':6A 'authent':3A 'command':8A 'cve':11A,14A 'fortio':1A 'fortios':17A 'let':4A 'miss':2A 'run':7A 'unauthent':5A","search_b":"'admin':52B 'appli':56B 'attack':42B 'authent':30B 'autoscal':18B,69B 'avail':26B,36B 'check':31B 'command':49B 'config':66B 'craft':44B 'execut':48B 'fgsp':19B,62B 'firewal':20B 'flaw':55B 'fortig':21B 'fortinet':22B 'fortio':23B,33B 'ha':45B,61B 'handl':38B 'high':25B,35B 'high-avail':24B,34B 'infrastructur':27B 'let':39B 'miss':29B 'packet':37B,46B 'right':53B 'send':43B 'standalon':65B 'standalone-config-sync':64B 'super':51B 'sync':67B 'system':59B 'unauthent':41B 'use':60B","search_c":"'7.2.0':90C '7.2.13':92C '7.4.0':86C '7.4.12':88C '7.6.0':82C '7.6.7':84C '8.0.0':80C 'admin':112C 'allow':94C 'attack':97C 'authent':72C 'autoscal':106C 'command':109C 'config':103C 'craft':114C 'critic':74C 'execut':108C 'fgsp':100C 'fortinet':78C 'fortio':79C,81C,85C,89C 'function':75C 'ha':99C,115C 'may':93C 'miss':71C 'packet':116C 'standalon':102C 'standalone-config-sync':101C 'super':111C 'sync':104C 'unauthent':96C 'via':113C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126259","severity":null,"published_at":"2026-11-11T22:17:26+00:00","modified_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126259:3602","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273","severity":null,"published_at":"2026-11-11T22:32:28+00:00","modified_at":"2026-11-11T22:32:28+00:00","first_seen_at":"2026-11-11T22:32:28+00:00","fetched_at":"2026-11-11T22:32:28+00:00","note":"Read Fortinet PSIRT FG-IR-26-273 (primary). Fixed versions, 7.0 all-versions affected, virtual patch FMWP 26.082 confirmed. No exploitation stated; advisory credits internal discovery. Mitigation (IPS virtual patch) in the fix text only; not marked verified.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-273","https://fortiguard.fortinet.com/psirt/FG-IR-26-273"]}],"documents":[{"id":129639,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273","title":"FG-IR-26-273 Unauthenticated adjacent command execution via HA","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129639,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273","title":"FG-IR-26-273 Unauthenticated adjacent command execution via HA","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}