Fortinet identifies a configured internal BGP neighbor as the prerequisite and lists denial of service as a possible impact.Fortinet rates the flaw Critical at CVSS 3.1 score 9.6. It published advisory FG-IR-26-268 on November 10, 2026.
What it allows
What Does CVE-2026-126254 Mean for BGP Deployments?
Fortinet identifies the internal BGP (iBGP) routing relationship in its description. Its CVSS 3.1 assessment records network reachability and low privileges, and the advisory identifies denial of service.
Fortinet’s vector also records high integrity and availability impacts. Network teams should map affected FortiOS devices to their configured peers and prioritize upgrades for routing infrastructure that supports critical services.
Review the network segmentation glossary when assessing peer reachability. The Fortinet release overview provides context for the wider security update.
Is CVE-2026-126254 Known to Be Exploited?
Fortinet marked this CVE Known Exploited: No when it published FG-IR-26-268. CISA KEV catalog version 2026.11.10 did not list the CVE.
These statements reflect the publication dates of the sources. Check the current advisory and CISA catalog when planning remediation.
For a separate BGP neighbor-dependent bgpd flaw, see the FRRouting CVE-2026-129456 profile.Who is affected
Which Versions Are Affected by CVE-2026-126254?
Fortinet provides separate instructions for FortiOS and FortiSASE. Check the exact installed build and follow the solution for its release line.
| Release line | Affected builds | Fortinet solution |
|---|---|---|
| FortiOS 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above |
| FortiOS 7.6 | 7.6.0 through 7.6.7 | Upgrade to 7.6.8 or above |
| FortiOS 7.4 | 7.4.0 through 7.4.12 | Upgrade to 7.4.13 or above |
| FortiOS 7.2 | 7.2.0 through 7.2.13 | Upgrade to 7.2.14 or above |
| FortiSASE 26.3 | 26.3.1 and 26.3.1_a | Fortinet remediated the issue in 26.3.2. No customer action needed for these releases. |
| FortiSASE 26.2, 26.1, 25.4, 25.3, 25.2, 25.1.a and 25.1 | All versions of each listed line | Migrate to a fixed release |
| FortiSASE 24.4, 24.3, 24.1, 23.4, 23.3, 23.2, 23.1 and 22.4 | Unaffected | No action for this CVE |
Fortinet says it remediated the listed FortiSASE 26.3 builds in 26.3.2. It directs customers on the older affected FortiSASE lines to migrate to a fixed release.
The vulnerability management guide explains how to schedule, track, and verify fixes. Check Fortinet’s advisory for changes before the maintenance window.
Timeline
- 2026-11-10
Fortinet published FG-IR-26-268 and marked Known Exploited as No.
- 2026-11-11
The Fortinet CVE record and NVD record for CVE-2026-126254 were published.
What to do
-
Inventory builds and BGP peers
Record FortiOS and FortiSASE versions. Identify which affected FortiOS devices have configured iBGP neighbors and support critical routing.
-
Plan the FortiOS upgrade
Use the fixed release for the installed branch and follow Fortinet’s supported upgrade path. Coordinate the maintenance window with network operations.
-
Verify service after maintenance
Confirm the installed build and check expected BGP peer status and route availability. Track each affected device until the upgrade and routing checks are complete.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is the impact of CVE-2026-126254?
Fortinet lists denial of service in the BGP daemon. Its assessment also records high integrity and availability impacts.
Does CVE-2026-126254 require a BGP peer?
Fortinet identifies a configured iBGP neighbor as the prerequisite. Its CVSS assessment assigns low privileges required.
Which FortiOS versions fix this BGP flaw?
The first listed fixed builds are 8.0.2, 7.6.8, 7.4.13, and 7.2.14 on their respective release lines.
Does the advisory cover FortiSASE?
Yes. Fortinet says it fixed the affected 26.3 builds in 26.3.2 and directs customers on the older affected lines to migrate.
Is CVE-2026-126254 listed in CISA KEV?
CISA KEV catalog version 2026.11.10 did not list this CVE. Fortinet marked Known Exploited as No at publication.
Sources
- FG-IR-26-268: Numeric truncation errorFortinet PSIRT
- CVE-2026-126254 CVE recordFortinet CVE Numbering Authority
- CVE-2026-126254 NVD recordNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
