9.0Kritisch

CVE-2026-126259

Fortinet FortiOS Veröffentlicht: 2026-11-12 00:31 (vor 5 Stunden)

Beschreibung

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.

Schwachstellentyp (CWE): CWE-306

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Fortinet	FortiOS	8.0.0, 7.6.0 – ≤ 7.6.7, 7.4.0 – ≤ 7.4.12, 7.2.0 – ≤ 7.2.13, 7.0.0 – ≤ 7.0.19

Referenzen und Patches

https://fortiguard.fortinet.com/psirt/FG-IR-26-273

CVSS-Score

9.0Kritisch

Quelle: fortinet · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Alle Scores (2)

cna	CVSS 3.1	9.0Kritisch
psirt@fortinet.com	CVSS 3.1	9.8Kritisch

Zeitverlauf

ID reserviert2026-11-10
Veröffentlicht2026-11-12 00:31
Bei IP-DB eingegangen2026-11-12 01:03
Zuletzt aktualisiert2026-11-12 01:17

Vergeben von (CNA): fortinet
NVD-Status: Received

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Fortinet (all products)

9.1Kritisch

CVE-2026-126229 vor 4 Stunden

Fortinet FortiManager; Fortinet FortiAnalyzer; Fortinet FortiManager Cloud; Fortinet FortiAnalyzer Cloud

A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Clo…

9.3Kritisch

CVE-2026-126262 vor 5 Stunden

Fortinet FortiAnalyzer; Fortinet FortiManager

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, Fort…

7.7Hoch

CVE-2026-121528 vor 5 Stunden

Fortinet FortiOS

A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication chann…

6.3Mittel

CVE-2026-121527 vor 5 Stunden

Fortinet FortiClientEMS

A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access…

7.4Hoch

CVE-2026-126255 vor 5 Stunden

Fortinet FortiOS; Fortinet FortiPAM

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, For…

7.4Hoch

CVE-2026-126256 vor 5 Stunden

Fortinet FortiOS

A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command v…