L3 · ShartedFortiOS · routing · HAfortios-november-routing-ha

Fortinet fixes critical FortiOS routing and HA flaws

Fortinet disclosed critical flaws affecting OSPF, iBGP and some FortiOS high-availability deployments. Upgrade to 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later in the corresponding branch to cover all three.

Disclosed: Nov 10, 2026; Public disclosure date
Severity: CVSS 9.6 × 1; 3 CVEs tracked here
Splash zone: OSPF and iBGP on FortiOS and FortiSASE. FortiOS FGSP with standalone-config-sync or autoscale.; fortinet
In the wild: Unknown; The Fortinet records reviewed here provide no evidence of exploitation.

What happened

These CVEs are part of the detailed advisories following Fortinet’s October priority upgrade notice. The OSPF path requires adjacent access, the BGP path requires a configured iBGP peer, and the HA path requires access to HA packets on an affected FGSP deployment with standalone-config-sync or an autoscale deployment.

For the routing flaws, FortiOS 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12 and 7.2.0–7.2.13 are affected. FortiOS 8.0.1 fixes the HA flaw on the 8.0 branch. Install 8.0.2 for the routing fixes. The affected HA versions in the 7.6, 7.4 and 7.2 branches match the routing ranges. The Fortinet CNA records additionally list 7.0.1–7.0.19 for OSPF and 7.0.0–7.0.19 for HA in their structured version tables, without a 7.0 fix.

Fortinet’s iBGP advisory lists FortiSASE 26.3.1 and 26.3.1_a as affected and says Fortinet applied the fix in 26.3.2. It directs customers on 26.2, 26.1, 25.4, 25.3, 25.2, 25.1.a and 25.1 to migrate to a fixed release. The OSPF advisory also names FortiSASE. Its machine-readable vulnerability record gives FortiOS fixes, so check the OSPF remediation for your tenant with Fortinet.

What’s in the bowl

CVE-2026-126253CVSS 9.3

OSPF authentication bypass

An unauthenticated attacker with adjacent OSPF access can send crafted requests that broadcast link-state advertisements.

CVE-2026-126254CVSS 9.6

iBGP propagation of malformed attributes

A configured iBGP neighbor can send crafted input that propagates malicious or malformed attributes to connected routers.

CVE-2026-126259CVSS 9

HA authentication bypass

An unauthenticated attacker who can reach affected HA traffic can send crafted packets to run commands as super admin when FGSP with standalone-config-sync or autoscale is in use.

Fixed versions

Product	Safe from	Note
FortiOS 8.0	`8.0.2`
FortiOS 7.6	`7.6.8`
FortiOS 7.4	`7.4.13`
FortiOS 7.2	`7.2.14`
FortiOS 7.0	No fix	Migrate to a supported fixed branch
FortiSASE 26.3	`26.3.2`	Vendor-applied iBGP fix

Crime-scene timeline

Nov 10, 2026
Fortinet publishes routing advisories
FG-IR-26-267 and FG-IR-26-268 describe the OSPF and iBGP flaws.
Nov 11, 2026
Fortinet publishes the three CNA records
The records give affected versions and separate the HA-only fix from the routing fixes on 8.0.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Fortinet PSIRT FG-IR-26-267 CSAFPrimaryOriginal OSPF advisory date and FortiOS fixes.
Fortinet PSIRT FG-IR-26-268 CSAFPrimaryOriginal iBGP advisory date and FortiOS and FortiSASE fixes.
Fortinet CNA CVE-2026-126253PrimaryOSPF requirements, score and structured 7.0 range.
Fortinet CNA CVE-2026-126254PrimaryConfigured iBGP neighbor requirement and affected ranges.
Fortinet CNA CVE-2026-126259PrimaryHA prerequisites, affected ranges and the HA-only 8.0.1 fix.

Wipe guide

The wipe checklist

0 of 4 sheets used

Identify and prioritize exposed devicesRun get system status on every unit. Check which interfaces run OSPF, which neighbors use iBGP, and whether FGSP with standalone-config-sync or autoscale is enabled. Restrict routing and HA traffic to trusted links or peers using your existing network controls while planning the upgrade.
Back up and upgrade the affected branchesBack up configurations and follow Fortinet’s model-specific upgrade path for all cluster members. For all three flaws, use FortiOS 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later in the respective branch. If you run 7.0, plan migration to a supported fixed branch. Verify the installed versions, routing adjacencies, route tables and HA health after the change.
Check your FortiSASE service versionFortinet applied the iBGP fix in 26.3.2 for the 26.3 line. Coordinate migration with Fortinet if you use an affected older line, and verify OSPF remediation with Fortinet.
Investigate unexpected routing or admin changesPreserve routing, HA and admin logs if you find unexplained route advertisements, peer resets or configuration changes. Compare route and config snapshots with your known-good baseline. If evidence points to privileged access, isolate the affected unit, investigate lateral access and rotate exposed credentials from a trusted system.