Fortinet has disclosed a set of critical vulnerabilities in FortiOS, the operating system that runs its FortiGate firewalls and network devices, as part of a batch of eight critical security advisories published on 10 November 2026. The FortiOS flaws affect routing and high-availability features, and the most serious carries a CVSS score of 9.6 out of 10. Fortinet reports no known exploitation of these flaws at publication, but the company has released fixes and administrators should apply them.

The disclosure covers FortiOS alongside FortiManager, FortiAnalyzer and FortiSASE products. The flaws in the management appliances, which could allow unauthenticated remote code execution, are a separate problem from the FortiOS issues described here, and administrators need to check each advisory against the products they run rather than assume one update fixes everything.

The most serious FortiOS flaw

The highest-rated FortiOS flaw is CVE-2026-126254, a numeric truncation error in the BGP daemon, the component that exchanges routing information between networks. It affects FortiOS releases in the 7.2, 7.4, 7.6 and 8.0 branches. A configured iBGP neighbour could send specially crafted attributes that push malformed routing data to connected routers, potentially disrupting routing across the network.

The flaw needs traffic from a router that is already configured as a trusted BGP neighbour, so it is not open to any attacker on the internet. Even so, a compromised or malicious neighbour could use it to interfere with routing, which makes it a serious risk for organisations that exchange routes with partners or within large networks.

Routing trust and high availability

Two further flaws weaken the trust FortiOS places in network protocols. CVE-2026-126253, rated 9.3, is an authentication bypass in the OSPF daemon that could let an attacker forge routing advertisements. CVE-2026-126229, rated 9.1, could let an authenticated administrator reach virtual domains, known as VDOMs, that sit outside their permitted scope.

A fourth flaw targets high-availability setups. CVE-2026-126259, rated 9.0, is a missing authentication check in FortiOS high availability. In deployments using high-availability FGSP with standalone configuration synchronisation, or autoscale, an unauthenticated attacker could send crafted high-availability packets and execute commands as a super admin. That is the highest privilege level on the device, so a successful attack would give an attacker full control of the firewall.

Affected versions and fixes

The affected FortiOS releases span the 7.2, 7.4, 7.6 and 8.0 branches, including FortiOS 8.0.0 and 8.0.1 for the BGP flaw. Fortinet has released fixed builds, with administrators advised to upgrade to 7.2.14, 7.4.13, 7.6.8 or 8.0.2 depending on their branch. Some fixes were listed as still upcoming when the advisories were published, including the FortiOS 7.6.8 fix for the high-availability flaw, so teams on those branches should check the advisory for their release and apply mitigations in the meantime.

Fortinet found almost all of the flaws in this batch internally, with help from the AI model Claude Mythos, according to security reporting on the disclosure. None of the eight new flaws had appeared in CISA's Known Exploited Vulnerabilities catalogue at publication, and Fortinet reports no attacks. Even without confirmed exploitation, the combination of high scores and the privileges at stake means these updates should not wait for the next maintenance window.