Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-126253: FortiOS can let outsiders broadcast network messages
CVE-2026-126253 · published today
Summary
Certain versions of FortiOS may allow a person without login credentials to send specially crafted requests that cause the device to broadcast false network information. This can let an attacker interfere with network routing or snoop on traffic. Apply the latest FortiOS updates or the vendor's recommended patches to close the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortios | <= 8.0.1 |
Original advisory text
A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow ...
A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-305Authentication Bypass by Primary Weakness
Timeline
Published11 Nov 2026
Updated11 Nov 2026
First seen11 Nov 2026
Track software like this
Free during beta