FortiOS HA FGSP and autoscale missing authentication allows unauthenticated command execution (CVE-2026-126259)

What happened

Fortinet describes CVE-2026-126259 as a missing authentication for critical function vulnerability (CWE-306) in FortiOS. It affects deployments configured for HA FGSP with standalone-config-sync, or autoscale. An unauthenticated attacker who can reach the HA channel can send crafted HA packets and execute commands with super-admin privileges.

A network path is enough; no credentials, user interaction or prior access are required. The CVSS 3.1 base score is 9, with high impact on confidentiality, integrity and availability. The SSVC assessment is automatable with total technical impact.

The CVE record does not indicate exploitation in the wild or public disclosure, and there is no CISA KEV entry for this flaw.

Who is affected

Affected releases are FortiOS 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13, and 7.0.0 through 7.0.19. The issue is specific to deployments using HA FGSP with standalone-config-sync, or autoscale. Check whether those configurations are present rather than assuming every FortiOS installation is exposed.

What to do now

1. Confirm whether you run an affected FortiOS release and whether HA FGSP with standalone-config-sync, or autoscale, is configured. Check each HA peer and the interfaces used for synchronisation.
2. No fixed release is listed yet. Monitor Fortinet's PSIRT advisory for updates.
3. Restrict access to the HA/FGSP synchronisation channel and autoscale management interfaces to trusted networks or dedicated VLANs. Disable standalone-config-sync or autoscale where they are not required.
4. Review super-admin activity and configuration changes for unexpected commands while the exposure remains.

How to detect it

The CVE record does not provide indicators of compromise. Start with exposure checks: confirm whether HA FGSP with standalone-config-sync, or autoscale, is enabled, and identify which interfaces and hosts can reach the HA synchronisation channel. Treat unexpected super-admin commands or configuration changes outside change windows as suspicious.

Beyond the patch

Beyond tracking Fortinet's advisory, this is a reminder that network-reachable synchronisation and management channels can turn a configuration choice into unauthenticated super-admin access. Virtual CISO Services can run the exposure review that catches an HA or autoscale channel reachable from places it should not be. Because no fixed release is listed yet, the exposure window is set by Fortinet's patch cadence and your ability to track affected appliances; Supply Chain Defense & Third-Party Risk keeps that vendor follow-up and inventory on a regular cycle.