Fortinet now lists fixes on the 7.4 and 7.2 branches for a FortiOS kernel vulnerability. Check your fleet’s builds and the other advisories that apply before revising an upgrade plan.
Fortinet published these advisories November 10, 2026. Its reviewed advisories mark known exploitation as No, and CISA KEV did not list these CVEs at verification November 11, 2026. Scores below are Fortinet’s CVSS 3.1 values.
What changed · November 11, 2026
Fortinet now lists fixes for the FortiOS 7.4 and 7.2 branches for FG-IR-26-270 (CVE-2026-126256). If this CVE drove a planned branch migration, recheck the model-specific path against 7.4.13 or 7.2.14 and validate the other advisories that apply. Fortinet’s timeline still shows the original November 10 publication. The matrix change was verified November 11.
What Fortinet disclosed
| Advisory and severity | Configuration and impact |
|---|---|
| FG-IR-26-273 · CVE-2026-126259 · Critical 9.0 | FGSP with standalone configuration sync, or autoscale, and reachable HA traffic. An unauthenticated peer can execute commands as super admin. |
| FG-IR-26-267 · CVE-2026-126253 · Critical 9.3 | Reachable OSPF traffic can allow an unauthenticated attacker to inject link-state advertisements. |
| FG-IR-26-268 · CVE-2026-126254 · Critical 9.6 | A configured iBGP neighbor can propagate malformed routing attributes. |
| FG-IR-26-270 · CVE-2026-126256 · High 7.4 | Kernel code or command execution. The summary says remote privileged attacker, while the attack-type field says unauthenticated. Treat the prerequisite as unresolved and limit reachability. |
| FG-IR-26-269 · CVE-2026-126255 · High 7.4 | SSH authentication bypass when the advisory’s GPC OS Login feature is enabled. The summary names FortiProxy, but the table gives no FortiProxy affected or fixed version. |
| FG-IR-26-272 · CVE-2026-126258 · High 7.1 | Reachable WAD proxy can let an unauthenticated attacker crash proxy or ZTNA sessions, per Fortinet’s summary. The advisory’s separate impact label is broader. |
| FG-IR-26-193 · CVE-2026-121528 · High 7.7 | SSL-VPN web portal to backend HTTPS certificate validation. Check whether the appliance proxies backend sites. |
FortiOS affected and fixed builds
For routing and SSH CVEs 126253, 126254 and 126255, affected 8.0.0–8.0.1 → 8.0.2+, 7.6.0–7.6.7 → 7.6.8+, 7.4.0–7.4.12 → 7.4.13+, and 7.2.0–7.2.13 → 7.2.14+. For HA CVE-2026-126259, 8.0.0 → 8.0.1+, with the same three other branch fixes.
For kernel CVE-2026-126256, affected FortiOS 8.0.0–8.0.1 → 8.0.2+, 7.6.0–7.6.7 → 7.6.8+, 7.4.0–7.4.12 → 7.4.13+, and 7.2.0–7.2.13 → 7.2.14+. Fortinet lists virtual patches for the HA and kernel flaws, FMWP 26.082 and 26.100 respectively. Verify coverage if using virtual patching until the firmware upgrade.
WAD CVE-2026-126258 affects 8.0.0 → 8.0.1+ and 7.6.7 → 7.6.8+. FortiOS 7.4 and 7.2 are listed as unaffected. SSL-VPN CVE-2026-121528 affects 7.6.0–7.6.4 → 7.6.5+, 7.4.0–7.4.9 → 7.4.10+, and 7.2.0–7.2.13 → 7.2.14+. FortiOS 8.0 is unaffected. On fixed versions, verify backend certificate trust and consider the documented reject-on-error behavior. The vendor default warns.
Fortinet remediated listed FortiSASE 26.3.1 and 26.3.1_a in 26.3.2 for CVEs 126253–126256 and says no customer action is needed for that upgrade. Older FortiSASE branch matrices vary. For SSH, FortiPAM 1.0 through 1.6 require migration, while 1.7, 1.8, 1.9 and 7.0 are listed as unaffected. Verify FortiProxy separately before closing that exposure.
Suggested MSP priority · urgent where reachable
Inventory HA and autoscale modes, OSPF and iBGP neighbors, SSH administration, WAD and SSL-VPN web mode. Restrict reachable paths to authorized peers and management networks where safe. Use Fortinet’s model-specific upgrade path, then verify actual builds, HA synchronization, routing neighbors, ZTNA and backend certificate handling. Investigate unexpected changes if found. No blanket rotation instruction was identified.
Official sources
FG-IR-26-273 · FG-IR-26-267 · FG-IR-26-268 · FG-IR-26-270 · FG-IR-26-269 · FG-IR-26-272 · FG-IR-26-193 · Fortinet upgrade path tool · CISA KEV data