Critical severity9.8NVD Advisory· Published Nov 11, 2026

CVE-2026-126259

Description

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fortinet/Fortiosinferred2 versions
7.2.0-<7.2.14, 7.4.0-<7.4.13, 7.6.0-<7.6.8, 8.0.0+ 1 more
- (no CPE)range: 7.2.0-<7.2.14, 7.4.0-<7.4.13, 7.6.0-<7.6.8, 8.0.0
- (no CPE)range: 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13

Patches

Vulnerability mechanics

References

fortiguard.fortinet.com/psirt/FG-IR-26-273nvd

News mentions

Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login
Cyber Security News · Nov 11, 2026

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000