Fortinet FortiOS and FortiSASE Vulnerable to Critical Authentication Bypass
A critical authentication bypass vulnerability in Fortinet's FortiOS and FortiSASE products allows unauthenticated attackers to broadcast Link State Advertisements (LSAs) via specially crafted requests.
Fortinet has disclosed a critical vulnerability, identified as CVE-2026-126253, affecting its FortiOS and FortiSASE operating systems. The flaw, categorized as an "Authentication Bypass by Primary Weakness" (CWE-305), resides within the ospf daemon and could permit an unauthenticated attacker to gain unauthorized access.
The vulnerability is exploitable through the broadcasting of Link State Advertisements (LSAs) by sending specially crafted requests. This mechanism allows an attacker to manipulate the Open Shortest Path First (OSPF) routing protocol, potentially leading to network disruption or unauthorized access to sensitive network information. The CVSSv3 score for this vulnerability is a critical 9.3, underscoring the severity of the potential impact.
This vulnerability was discovered internally by Loic Pantano of the Fortinet Product Security team, with assistance from the "Claude Mythos" AI model. The disclosure highlights the increasing role of AI in identifying security weaknesses, as well as the internal efforts by vendors to proactively secure their products.
A wide range of FortiOS versions are affected, from the latest 8.0.1 down to 7.2.0. Similarly, multiple versions of FortiSASE, including 26.3.1 down to 25.1.a, are also impacted. Fortinet has provided a comprehensive list of affected versions in its advisory, urging users to consult it for specific details.
While the advisory does not explicitly state whether this vulnerability is being actively exploited in the wild, its critical severity and the nature of the bypass mechanism suggest a high potential for exploitation. Organizations utilizing affected versions of FortiOS or FortiSASE should prioritize updating their systems to mitigate the risk.
Fortinet has released patches for the affected versions. Users are strongly advised to update their systems to the latest available versions as soon as possible. The company's advisory provides detailed information on the affected products and the corresponding fixed versions, enabling administrators to plan and implement necessary updates.
This vulnerability underscores the ongoing challenges in securing network infrastructure, particularly routing protocols that are fundamental to network operation. The ability for an unauthenticated attacker to manipulate OSPF LSAs can have far-reaching consequences, potentially impacting network stability and security posture.