External risk intelligence

FortiOS Missing Authentication for Critical Function Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-126259

The vulnerability affects FortiOS, which is commonly deployed as an internet-facing edge gateway or security appliance. While the specific exploit involves HA or autoscale packets, the product's role as a primary internet-facing device makes it highly likely to be reachable in environments where these configurations are used.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Fortinet's FortiOS, impacting network devices. This issue could potentially allow unauthorized command execution with administrative privileges on affected systems. The main concern is to confirm if our environment utilizes the specific configurations that could be exposed.

Unauthorized administrative access is possible.
Affects critical network security appliances.
Confirm relevance and exposure in our environment.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted High Availability (HA) packets to a vulnerable FortiOS system. This could lead to arbitrary command execution with super administrator privileges.

Attacker sends crafted HA packets.
Vulnerable FortiOS system receives packets.
Arbitrary command execution with super admin privileges.

Live Threat

Current exploitation, exposure, and threat context

A critical function lacks authentication in Fortinet FortiOS, potentially allowing an unauthenticated attacker to execute commands with super admin privileges. This could occur when specific High Availability (HA) or autoscale configurations are in place, enabling the execution of crafted HA packets.

Super admin command execution.
Via crafted HA or autoscale packets.
System compromise or data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability likely impacts network and security teams responsible for Fortinet edge devices and potentially platform teams managing HA or autoscale configurations. The first step is to inventory all FortiOS instances, confirm their exposure and business criticality, and identify the accountable owners. Following this assessment, a risk-based remediation plan can be developed, coordinating with relevant teams and potentially the vendor.

Identify and confirm affected systems.
Verify HA or autoscale configurations.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FortiOS and where is it used?

FortiOS is the core operating system powering Fortinet's security appliances, such as firewalls and gateways. It is designed to manage network traffic, enforce security policies, and protect enterprise perimeters. Because it acts as the gatekeeper for network boundaries, these devices are typically positioned at the edge of a network to control inbound and outbound traffic flows.

How does CVE-2026-126259 create a security risk?

This vulnerability is classified as 'Missing Authentication for Critical Function' (CWE-306). It means that a sensitive part of the system software performs its duties without checking the identity of the user. Because this flaw is in a critical function, an unauthorized person could potentially bypass standard security checks to issue commands with the highest level of administrative authority.

Does any network traffic trigger this vulnerability?

No. The flaw is specifically tied to the processing of High Availability (HA) or autoscale synchronization packets. It is not triggered by standard user traffic or common management protocols. For the vulnerability to be relevant, the system must be configured to use specific HA settings or autoscale features that process these crafted packets.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal identifies this as an external risk because FortiOS devices often serve as internet-facing gateways. Since these appliances are intentionally placed at the network edge to communicate with the outside world, they are more likely to be reachable by external entities that could transmit the specific packets required to trigger the vulnerability.

How should I begin addressing this issue?

Start by creating an inventory of all FortiOS instances within your environment. Verify whether those specific systems are currently running the affected versions and if they utilize the mentioned High Availability or autoscale configurations. Once identified, consult the official vendor guidance to determine the appropriate path for remediation or configuration changes to secure the affected management functions.

References

fortiguard.fortinet.com/psirt/FG-IR-26-273

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.