Authentication bypass by primary weakness

🚨SEVERITY: CRITICAL — CVSS 9.3Security Advisory

TL;DR 📌

  • CVSSv3 Score: 9.3 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA via specially crafted request Revised on 2026-11-10 00:00:00
  • Highest CVSS: 9.3 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-126253.

What it is

CVE-2026-126253 is an authentication bypass by primary weakness (CWE-305) in the OSPF daemon used by FortiOS and FortiSASE. The weakness sits in how the daemon handles OSPF protocol messages rather than in any management interface.

According to Fortinet, an unauthenticated attacker can exploit this by sending a specially crafted request that causes the daemon to broadcast an LSA (Link State Advertisement). This points to the OSPF routing process itself as the reachable component, meaning exposure depends on whether OSPF is enabled and reachable from an untrusted network or segment, rather than on any admin GUI or API credential.

Fortinet rates this 9.3, CRITICAL. The advisory does not describe what an attacker can do beyond triggering the LSA broadcast, so readers should treat this as a routing-protocol-level authentication bypass and consult the advisory directly for the full technical detail of impact.

What to do

  • Check whether OSPF is enabled on affected FortiOS or FortiSASE deployments; if it isn’t in use, disable it to remove the attack surface entirely.
  • Where OSPF is required, restrict which interfaces and neighbours can send it protocol traffic — don’t leave OSPF reachable from untrusted networks.
  • The advisory does not list fixed versions in the data reviewed here, so consult FG-IR-26-267 directly for the specific builds that resolve CVE-2026-126253 and patch as soon as they’re confirmed.
  • This is not listed in CISA’s Known Exploited Vulnerabilities catalogue at the time of writing, but given the 9.3 CVSS score, treat patching as high priority regardless.

For leadership 🧭

Executive summary. Devices running FortiOS or FortiSASE with OSPF routing enabled can be made to respond to crafted protocol messages from someone with no credentials at all, a critical-rated weakness at 9.3 CVSS. Fortinet has not yet published fixed versions, so immediate containment through network segmentation is the only available mitigation until a patch is confirmed.

Why it matters:

  • The flaw is in the OSPF daemon itself, not an admin GUI or API, so any segment where OSPF is enabled and reachable is a potential entry point regardless of login credentials.
  • An unauthenticated attacker only needs to send a crafted request to trigger an LSA broadcast — no account, token, or prior access to the device is required.
  • Fortinet has not published fixed releases for CVE-2026-126253 in the information reviewed, so patching cannot yet close this gap and compensating controls are the only option.
  • At 9.3 CRITICAL, this sits near the top of Fortinet’s severity scale, and OSPF is commonly run on internal routing infrastructure that may be assumed trusted but isn’t locked down against untrusted neighbours.

Now / Next / Later:

  • Now: Identify every FortiOS and FortiSASE device with OSPF enabled and confirm which network segments or neighbours can send it protocol traffic.
  • Next: Disable OSPF on devices where it isn’t actually required, and on those where it is, restrict OSPF-speaking interfaces to known, trusted neighbours only during your next change window.
  • Later: Track FG-IR-26-267 for fixed FortiOS/FortiSASE releases and apply them as soon as Fortinet confirms them, then add routing-protocol exposure checks to your standard Fortinet hardening baseline.

Source