Fortinet classifies the impact as improper access control and assigns an adjacent network attack vector with no credentials required.Fortinet rates the flaw Critical at CVSS 3.1 score 9.3. It published advisory FG-IR-26-267 on November 10, 2026.
What it allows
What Does CVE-2026-126253 Mean for OSPF Deployments?
Fortinet identifies the OSPF routing process as the affected component. Its CVSS 3.1 assessment requires adjacent network access and assigns no privileges required.
Fortinet’s score records high integrity and availability impacts. Network teams should identify the interfaces where they run OSPF and check whether the adjacent segments are restricted to expected devices.
The network segmentation glossary explains how teams separate network zones. The Fortinet security release overview covers the broader product update.
Is CVE-2026-126253 Known to Be Exploited?
Fortinet marked this CVE Known Exploited: No when it published FG-IR-26-267. CISA KEV catalog version 2026.11.10 did not list the CVE.
These statements reflect the publication dates of the sources. Check the current advisory and CISA catalog when planning remediation.
Who is affected
Which Versions Are Affected by CVE-2026-126253?
Fortinet lists four FortiOS lines with an in-branch fix and a separate migration instruction for affected FortiOS 7.0 builds. It also provides FortiSASE guidance.
| Release line | Affected builds | Fortinet solution |
|---|---|---|
| FortiOS 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above |
| FortiOS 7.6 | 7.6.0 through 7.6.7 | Upgrade to 7.6.8 or above |
| FortiOS 7.4 | 7.4.0 through 7.4.12 | Upgrade to 7.4.13 or above |
| FortiOS 7.2 | 7.2.0 through 7.2.13 | Upgrade to 7.2.14 or above |
| FortiOS 7.0 | 7.0.1 through 7.0.19 | Migrate to a fixed release |
| FortiSASE 26.3 | 26.3.1 and 26.3.1_a | Fortinet remediated the issue in 26.3.2. No customer action needed for these releases. |
| FortiSASE 26.2, 26.1, 25.4, 25.3, 25.2, 25.1.a and 25.1 | All versions of each listed line | Migrate to a fixed release |
| FortiSASE 24.4, 24.3, 24.1, 23.4, 23.3, 23.2, 23.1 and 22.4 | Unaffected | No action for this CVE |
For FortiOS 7.0.1 through 7.0.19, Fortinet directs teams to migrate to a fixed release. Fortinet says it remediated the listed FortiSASE 26.3 builds in 26.3.2.
The vulnerability management guide explains how to schedule, track, and verify fixes. Check Fortinet’s advisory for changes before the maintenance window.
Timeline
- 2026-11-10
Fortinet published FG-IR-26-267 and marked Known Exploited as No.
- 2026-11-11
The Fortinet CVE record and NVD record for CVE-2026-126253 were published.
What to do
-
Inventory OSPF deployments
Record FortiOS and FortiSASE releases and identify where OSPF runs. Use the release matrix to determine which deployments need an update or migration.
-
Apply the vendor fix
Use the listed fixed build for the relevant FortiOS branch. Plan a supported migration for affected FortiOS 7.0 and older affected FortiSASE lines.
-
Verify routing after maintenance
Confirm the fixed build, expected OSPF adjacency status, and route availability. Review routing logs for unexplained changes and investigate with network operations.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Does CVE-2026-126253 require authentication?
Fortinet’s CVSS assessment specifies adjacent network access and no privileges required.
What should teams running FortiOS 7.0 do?
Fortinet lists 7.0.1 through 7.0.19 as affected and directs those deployments to migrate to a fixed release.
Which FortiOS builds fix this OSPF vulnerability?
Fortinet lists 8.0.2, 7.6.8, 7.4.13, and 7.2.14 as the first fixed builds in their branches.
What does Fortinet say about FortiSASE 26.3?
Fortinet lists 26.3.1 and 26.3.1_a as affected and says it remediated them in 26.3.2.
Is CVE-2026-126253 listed in CISA KEV?
CISA KEV catalog version 2026.11.10 did not list this CVE. Fortinet marked Known Exploited as No at publication.
Sources
- FG-IR-26-267: Authentication bypass by primary weaknessFortinet PSIRT
- CVE-2026-126253 CVE recordFortinet CVE Numbering Authority
- CVE-2026-126253 NVD recordNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
