---
id: "CVE-2026-126259"
page: "https://infrastack.ai/live/CVE-2026-126259"
kind: "vulnerability"
aliases: ["CVE-2026-126259"]
title: "FortiOS: missing authentication lets unauthenticated attackers run commands as admin"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiOS", "fixed": ["8.0.1", "7.6.8", "7.4.13", "7.2.14"], "affected": "8.0.0; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.12; >= 7.2.0, <= 7.2.13; 7.0 all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["autoscale", "fgsp", "firewall", "fortigate", "fortinet", "fortios", "high-availability", "infrastructure"]
not_affected_if: ["default-config", "no-autoscale", "no-fgsp-config-sync", "no-fgsp-or-autoscale"]
published_at: "2026-11-11T22:17:26+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:32:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126259", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-273", "first_seen_at": "2026-11-11T22:32:28+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-273", "https://fortiguard.fortinet.com/psirt/FG-IR-26-273"]}]
exploit_sources: []
---

# FortiOS: missing authentication lets unauthenticated attackers run commands as admin

Link for people: https://infrastack.ai/live/CVE-2026-126259 (this .md is for agents)

A missing authentication check in FortiOS high-availability packet handling lets an unauthenticated attacker send crafted HA packets and execute commands with super admin rights. The flaw applies only to systems using HA FGSP with standalone-config-sync or autoscale.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiOS affected 8.0.0; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.12; >= 7.2.0, <= 7.2.13; 7.0 all versions fixed 8.0.1, 7.6.8, 7.4.13, 7.2.14

## How to check

Run 'get system status' on the FortiGate and compare the version with: 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13, any 7.0. Then check the config for HA FGSP with standalone-config-sync enabled, or an autoscale setup. Devices without those are outside the stated condition, but upgrade anyway.

## Fix

Upgrade FortiOS 8.0 to 8.0.1+, 7.6 to 7.6.8+, 7.4 to 7.4.13+, 7.2 to 7.2.14+. FortiOS 7.0 (all versions) has no fix in branch: migrate to a fixed release. Upgrade path tool: https://docs.fortinet.com/upgrade-tool. Interim: Fortinet IPS virtual patch FG-VD-61445.0day in FMWP db update 26.082.

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126259
- 2026-11-11T22:32:28+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-273 — Read Fortinet PSIRT FG-IR-26-273 (primary). Fixed versions, 7.0 all-versions affected, virtual patch FMWP 26.082 confirmed. No exploitation stated; advisory credits internal discovery. Mitigation (IPS virtual patch) in the fix text only; not marked verified.

## Documents

- [advisory] FG-IR-26-273 Unauthenticated adjacent command execution via HA https://fortiguard.fortinet.com/psirt/FG-IR-26-273
- [mitigation] FG-IR-26-273 Unauthenticated adjacent command execution via HA https://fortiguard.fortinet.com/psirt/FG-IR-26-273

## From the sources

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_