{"affected":[{"defaultStatus":"unaffected","product":"FortiOS","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.1","versionType":"semver"}]}],"cveId":"CVE-2026-126253","cwes":["CWE-305"],"description":"A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.3,"severity":"critical","source":"CNA: fortinet","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C","version":"3.1"}],"modifiedAt":1794432707633,"publishedAt":1794432707633,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above\nUpgrade to FortiOS version 7.4.13 or above\nUpgrade to FortiOS version 7.2.14 or above"}],"revision":"6814a94eab45007955cac54620fe8e2ac2c16ef9af69ff730e6aede06e21d776","sources":[{"modifiedAt":1794432707633,"name":"CNA: fortinet","retrievedAt":1794435025955,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126253"}],"ssvc":null,"status":"published","title":"CVE-2026-126253","updatedAt":1794435025955}