At a glance
- Fortinet warns of CVE-2026-126254 in the BGP daemon, which could cause denial of service.
- FortiOS and some FortiSASE branches are affected; the stated attack condition is a configured iBGP neighbor.
- CVSSv3 9.6; Known Exploited: No.
- Check versions and upgrade or move affected branches according to Fortinet's guidance.
Fortinet warns of CVE-2026-126254 in FortiOS and FortiSASE; upgrade affected systems
Fortinet warns that CVE-2026-126254 in the FortiOS and FortiSASE BGP daemon could cause denial of service. The flaw has CVSSv3 9.6 and requires a configured iBGP neighbor. Check versions and upgrade FortiOS or move affected FortiSASE branches to a fixed release.
In this article
Fortinet published an advisory for CVE-2026-126254 in the FortiOS and FortiSASE BGP daemon. The flaw could lead to denial of service; affected versions and recommended actions are listed below.
Overview and technical details
The Numeric Truncation Error is tracked as CVE-2026-126254 and has a CVSSv3 score of 9.6. Fortinet lists CWE-197 and Known Exploited status as No.
| Field | Details |
|---|---|
| Products | FortiOS, FortiSASE |
| Identifiers | CVE-2026-126254; CWE-197 |
| CVSS score | CVSSv3 9.6 |
| Exploitation status | Known Exploited: No |
| Source | Fortinet PSIRT |
Affected systems
The following FortiOS ranges are affected. Upgrade to the corresponding fixed version or a later version in the branch.
| Product | Affected versions | Fixed version |
|---|---|---|
| FortiOS | 8.0.0–8.0.1 | 8.0.2 or later |
| FortiOS | 7.6.0–7.6.7 | 7.6.8 or later |
| FortiOS | 7.4.0–7.4.12 | 7.4.13 or later |
| FortiOS | 7.2.0–7.2.13 | 7.2.14 or later |
| FortiSASE | 26.3.1, 26.3.1_a | 26.3.2 |
| FortiSASE | 26.2, 26.1, 25.4, 25.3, 25.2, 25.1.a, 25.1 — all versions | Move to a fixed release |
FortiSASE 24.4, 24.3, 24.1, 23.4, 23.3, 23.2, 23.1, and 22.4 are unaffected. For FortiSASE 26.3.1 and 26.3.1_a, Fortinet says the issue was fixed in 26.3.2 and customers do not need to take action.
Mechanism and impact
A configured iBGP neighbor can send malicious or malformed attributes to all connected routers using a specially crafted request. The stated impact is denial of service; the attack type is listed as authenticated.
Exploitation status
Fortinet lists Known Exploited status as No. The advisory does not provide a CVSS vector.
System checks
Check the FortiOS version currently running on the device with this command:
get system statusCompare the displayed version with the affected FortiOS ranges. If it falls within an affected range, upgrade to the corresponding fixed version.
Remediation and mitigation
Upgrade FortiOS to the corresponding fixed version, following Fortinet's recommended upgrade path. Fortinet recommends using the Upgrade Tool to follow the correct path.
For affected FortiSASE branches, move to a fixed release. FortiSASE 26.3.1 and 26.3.1_a were fixed in 26.3.2; customers using these versions do not need to take action.
Virtual patch FG-VD-62507.0day is available in FMWP db update 26.118.
References
Related articles
Palo Alto PAN-OS: Patch CVE-2026-0325 IP address limit bypass
Palo Alto Networks warns that CVE-2026-0325 in the PAN-OS GlobalProtect gateway lets users with valid credentials bypass IP address limits and source-IP-based access controls. Check gateway configuration and upgrade affected branches to their corresponding fixed versions.