{"affected":[{"defaultStatus":"unaffected","product":"FortiOS","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"FortiPAM","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"1.6.2","status":"affected","version":"1.6.0","versionType":"semver"},{"lessThanOrEqual":"1.5.1","status":"affected","version":"1.5.0","versionType":"semver"},{"lessThanOrEqual":"1.4.3","status":"affected","version":"1.4.0","versionType":"semver"},{"lessThanOrEqual":"1.3.1","status":"affected","version":"1.3.0","versionType":"semver"},{"status":"affected","version":"1.2.0"},{"lessThanOrEqual":"1.1.2","status":"affected","version":"1.1.0","versionType":"semver"},{"lessThanOrEqual":"1.0.3","status":"affected","version":"1.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-126255","cwes":["CWE-24"],"description":"A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: fortinet","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C","version":"3.1"}],"modifiedAt":1794432712405,"publishedAt":1794432712405,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to upcoming  FortiPAM version 7.0.1 or above\nUpgrade to FortiPAM version 1.9.3 or above\nUpgrade to upcoming  FortiPAM version 1.8.5 or above\nUpgrade to upcoming  FortiPAM version 1.7.3 or above\nUpgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above\nUpgrade to FortiOS version 7.4.13 or above\nUpgrade to FortiOS version 7.2.14 or above"}],"revision":"32fb760f65db1c372cebc512821c3dbd4823e4d79a2e64c3d3ae7e97d73f2e84","sources":[{"modifiedAt":1794432712405,"name":"CNA: fortinet","retrievedAt":1794435028189,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126255"}],"ssvc":null,"status":"published","title":"CVE-2026-126255","updatedAt":1794435028189}