Vulnerability CVE-2026-126260
Published Sources: HKCERT, BSI
What is affected, what to do
Multiple vulnerabilities were identified in Fortinet Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, security restriction bypass, sensitive information disclosure, remote code execution, data manipulation and spoofing on the targeted system.
The available sources name no fixed version. Check the vendor guidance and the linked original advisory.
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
—
XIEM Effective CVSS
No value is available for this vulnerability.
—
CVSS v3
No value is available for this vulnerability.
—
EPSS score
No value is available for this vulnerability.
Show all metrics
- Severity
- Reserved
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 136.20 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- no public PoC known
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- —
- Published
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Multiple vulnerabilities were identified in Fortinet Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, security restriction bypass, sensitive information disclosure, remote code execution, data manipulation and spoofing on the targeted system. Impact: Information Disclosure Cross-Site Scripting Denial of Service Data Manipulation Elevation of Privilege Remote Code Execution Security Restriction Bypass System / Technologies affected: For affected products, please refer to the link below: https://fortiguard.fortinet.com/psirt/FG-IR-26-190 https://fortiguard.fortinet.com/psirt/FG-IR-26-191 https://fortiguard.fortinet.com/psirt/FG-IR-26-192 https://fortiguard.fortinet.com/psirt/FG-IR-26-193 https://fortiguard.fortinet.com/psirt/FG-IR-26-194 https://fortiguard.fortinet.com/psirt/FG-IR-26-195 https://fortiguard.fortinet.com/psirt/FG-IR-26-196 https://fortiguard.fortinet.com/psirt/FG-IR-26-197 https://fortiguard.fortinet.com/psirt/FG-IR-26-198 https://fortiguard.fortinet.com/psirt/FG-IR-26-199 https://fortiguard.fortinet.com/psirt/FG-IR-26-200 https://fortiguard.fortinet.com/psirt/FG-IR-26-201 https://fortiguard.fortinet.com/psirt/FG-IR-26-202 https://fortiguard.fortinet.com/psirt/FG-IR-26-203 https://fortiguard.fortinet.com/psirt/FG-IR-26-204 https://fortiguard.fortinet.com/psirt/FG-IR-26-205 https://fortiguard.fortinet.com/psirt/FG-IR-26-206 https://fortiguard.fortinet.com/psirt/FG-IR-26-207 https://fortiguard.fortinet.com/psirt/FG-IR-26-208 https://fortiguard.fortinet.com/psirt/FG-IR-26-209 https://fortiguard.fortinet.com/psirt/FG-IR-26-210 https://fortiguard.fortinet.com/psirt/FG-IR-26-211 https://fortiguard.fortinet.com/psirt/FG-IR-26-212 https://fortiguard.fortinet.com/psirt/FG-IR-26-213 https://fortiguard.fortinet.com/psirt/FG-IR-26-214 https://fortiguard.fortinet.com/psirt/FG-IR-26-215 https://fortiguard.fortinet.com/psirt/FG-IR-26-216 https://fortiguard.fortinet.com/psirt/FG-IR-26-217 https://fortiguard.fortinet.com/psirt/FG-IR-26-218 https://fortiguard.fortinet.com/psirt/FG-IR-26-219 https://fortiguard.fortinet.com/psirt/FG-IR-26-220 https://fortiguard.fortinet.com/psirt/FG-IR-26-221 https://fortiguard.fortinet.com/psirt/FG-IR-26-222 https://fortiguard.fortinet.com/psirt/FG-IR-26-223 https://fortiguard.fortinet.com/psirt/FG-IR-26-224 https://fortiguard.fortinet.com/psirt/FG-IR-26-225 https://fortiguard.fortinet.com/psirt/FG-IR-26-226 https://fortiguard.fortinet.com/psirt/FG-IR-26-227 https://fortiguard.fortinet.com/psirt/FG-IR-26-228 https://fortiguard.fortinet.com/psirt/FG-IR-26-229 https://fortiguard.fortinet.com/psirt/FG-IR-26-230 https://fortiguard.fortinet.com/psirt/FG-IR-26-231 https://fortiguard.fortinet.com/psirt/FG-IR-26-232 https://fortiguard.fortinet.com/psirt/FG-IR-26-233 https://fortiguard.fortinet.com/psirt/FG-IR-26-234 https://fortiguard.fortinet.com/psirt/FG-IR-26-235 https://fortiguard.fortinet.com/psirt/FG-IR-26-236 https://fortiguard.fortinet.com/psirt/FG-IR-26-237 https://fortiguard.fortinet.com/psirt/FG-IR-26-238 https://fortiguard.fortinet.com/psirt/FG-IR-26-239 https://fortiguard.fortinet.com/psirt/FG-IR-26-240 https://fortiguard.fortinet.com/psirt/FG-IR-26-241 https://fortiguard.fortinet.com/psirt/FG-IR-26-242 https://fortiguard.fortinet.com/psirt/FG-IR-26-243 https://fortiguard.fortinet.com/psirt/FG-IR-26-244 https://fortiguard.fortinet.com/psirt/FG-IR-26-246 https://fortiguard.fortinet.com/psirt/FG-IR-26-247 https://fortiguard.fortinet.com/psirt/FG-IR-26-248 https://fortiguard.fortinet.com/psirt/FG-IR-26-249 https://fortiguard.fortinet.com/psirt/FG-IR-26-250 https://fortiguard.fortinet.com/psirt/FG-IR-26-251 https://fortiguard.fortinet.com/psirt/FG-IR-26-252 https://fortiguard.fortinet.com/psirt/FG-IR-26-253 https://fortiguard.fortinet.com/psirt/FG-IR-26-255 https://fortiguard.fortinet.com/psirt/FG-IR-26-256 https://fortiguard.fortinet.com/psirt/FG-IR-26-257 https://fortiguard.fortinet.com/psirt/FG-IR-26-258 https://fortiguard.fortinet.com/psirt/FG-IR-26-259 https://fortiguard.fortinet.com/psirt/FG-IR-26-260 https://fortiguard.fortinet.com/psirt/FG-IR-26-261 https://fortiguard.fortinet.com/psirt/FG-IR-26-262 https://fortiguard.fortinet.com/psirt/FG-IR-26-263 https://fortiguard.fortinet.com/psirt/FG-IR-26-264 https://fortiguard.fortinet.com/psirt/FG-IR-26-265 https://fortiguard.fortinet.com/psirt/FG-IR-26-266 https://fortiguard.fortinet.com/psirt/FG-IR-26-267 https://fortiguard.fortinet.com/psirt/FG-IR-26-268 https://fortiguard.fortinet.com/psirt/FG-IR-26-269 https://fortiguard.fortinet.com/psirt/FG-IR-26-270 https://fortiguard.fortinet.com/psirt/FG-IR-26-271 https://fortiguard.fortinet.com/psirt/FG-IR-26-272 https://fortiguard.fortinet.com/psirt/FG-IR-26-273 https://fortiguard.fortinet.com/psirt/FG-IR-26-274 https://fortiguard.fortinet.com/psirt/FG-IR-26-275 https://fortiguard.fortinet.com/psirt/FG-IR-26-276 https://fortiguard.fortinet.com/psirt/FG-IR-26-277 Solutions: Before installation of the software, please visit the vendor web-site for more details. Apply fixes issued by the vendor: https://fortiguard.fortinet.com/psirt/FG-IR-26-190 https://fortiguard.fortinet.com/psirt/FG-IR-26-191 https://fortiguard.fortinet.com/psirt/FG-IR-26-192 https://fortiguard.fortinet.com/psirt/FG-IR-26-193 https://fortiguard.fortinet.com/psirt/FG-IR-26-194 https://fortiguard.fortinet.com/psirt/FG-IR-26-195 https://fortiguard.fortinet.com/psirt/FG-IR-26-196 https://fortiguard.fortinet.com/psirt/FG-IR-26-197 https://fortiguard.fortinet.com/psirt/FG-IR-26-198 https://fortiguard.fortinet.com/psirt/FG-IR-26-199 https://fortiguard.fortinet.com/psirt/FG-IR-26-200 https://fortiguard.fortinet.com/psirt/FG-IR-26-201 https://fortiguard.fortinet.com/psirt/FG-IR-26-202 https://fortiguard.fortinet.com/psirt/FG-IR-26-203 https://fortiguard.fortinet.com/psirt/FG-IR-26-204 https://fortiguard.fortinet.com/psirt/FG-IR-26-205 https://fortiguard.fortinet.com/psirt/FG-IR-26-206 https://fortiguard.fortinet.com/psirt/FG-IR-26-207 https://fortiguard.fortinet.com/psirt/FG-IR-26-208 https://fortiguard.fortinet.com/psirt/FG-IR-26-209 https://fortiguard.fortinet.com/psirt/FG-IR-26-210 https://fortiguard.fortinet.com/psirt/FG-IR-26-211 https://fortiguard.fortinet.com/psirt/FG-IR-26-212 https://fortiguard.fortinet.com/psirt/FG-IR-26-213 https://fortiguard.fortinet.com/psirt/FG-IR-26-214 https://fortiguard.fortinet.com/psirt/FG-IR-26-215 https://fortiguard.fortinet.com/psirt/FG-IR-26-216 https://fortiguard.fortinet.com/psirt/FG-IR-26-217 https://fortiguard.fortinet.com/psirt/FG-IR-26-218 https://fortiguard.fortinet.com/psirt/FG-IR-26-219 https://fortiguard.fortinet.com/psirt/FG-IR-26-220 https://fortiguard.fortinet.com/psirt/FG-IR-26-221 https://fortiguard.fortinet.com/psirt/FG-IR-26-222 https://fortiguard.fortinet.com/psirt/FG-IR-26-223 https://fortiguard.fortinet.com/psirt/FG-IR-26-224 https://fortiguard.fortinet.com/psirt/FG-IR-26-225 https://fortiguard.fortinet.com/psirt/FG-IR-26-226 https://fortiguard.fortinet.com/psirt/FG-IR-26-227 https://fortiguard.fortinet.com/psirt/FG-IR-26-228 https://fortiguard.fortinet.com/psirt/FG-IR-26-229 https://fortiguard.fortinet.com/psirt/FG-IR-26-230 https://fortiguard.fortinet.com/psirt/FG-IR-26-231 https://fortiguard.fortinet.com/psirt/FG-IR-26-232 https://fortiguard.fortinet.com/psirt/FG-IR-26-233 https://fortiguard.fortinet.com/psirt/FG-IR-26-234 https://fortiguard.fortinet.com/psirt/FG-IR-26-235 https://fortiguard.fortinet.com/psirt/FG-IR-26-236 https://fortiguard.fortinet.com/psirt/FG-IR-26-237 https://fortiguard.fortinet.com/psirt/FG-IR-26-238 https://fortiguard.fortinet.com/psirt/FG-IR-26-239 https://fortiguard.fortinet.com/psirt/FG-IR-26-240 https://fortiguard.fortinet.com/psirt/FG-IR-26-241 https://fortiguard.fortinet.com/psirt/FG-IR-26-242 https://fortiguard.fortinet.com/psirt/FG-IR-26-243 https://fortiguard.fortinet.com/psirt/FG-IR-26-244 https://fortiguard.fortinet.com/psirt/FG-IR-26-246 https://fortiguard.fortinet.com/psirt/FG-IR-26-247 https://fortiguard.fortinet.com/psirt/FG-IR-26-248 https://fortiguard.fortinet.com/psirt/FG-IR-26-249 https://fortiguard.fortinet.com/psirt/FG-IR-26-250 https://fortiguard.fortinet.com/psirt/FG-IR-26-251 https://fortiguard.fortinet.com/psirt/FG-IR-26-252 https://fortiguard.fortinet.com/psirt/FG-IR-26-253 https://fortiguard.fortinet.com/psirt/FG-IR-26-255 https://fortiguard.fortinet.com/psirt/FG-IR-26-256 https://fortiguard.fortinet.com/psirt/FG-IR-26-257 https://fortiguard.fortinet.com/psirt/FG-IR-26-258 https://fortiguard.fortinet.com/psirt/FG-IR-26-259 https://fortiguard.fortinet.com/psirt/FG-IR-26-260 https://fortiguard.fortinet.com/psirt/FG-IR-26-261 https://fortiguard.fortinet.com/psirt/FG-IR-26-262 https://fortiguard.fortinet.com/psirt/FG-IR-26-263 https://fortiguard.fortinet.com/psirt/FG-IR-26-264 https://fortiguard.fortinet.com/psirt/FG-IR-26-265 https://fortiguard.fortinet.com/psirt/FG-IR-26-266 https://fortiguard.fortinet.com/psirt/FG-IR-26-267 https://fortiguard.fortinet.com/psirt/FG-IR-26-268 https://fortiguard.fortinet.com/psirt/FG-IR-26-269 https://fortiguard.fortinet.com/psirt/FG-IR-26-270 https://fortiguard.fortinet.com/psirt/FG-IR-26-271 https://fortiguard.fortinet.com/psirt/FG-IR-26-272 https://fortiguard.fortinet.com/psirt/FG-IR-26-273 https://fortiguard.fortinet.com/psirt/FG-IR-26-274 https://fortiguard.fortinet.com/psirt/FG-IR-26-275 https://fortiguard.fortinet.com/psirt/FG-IR-26-276 https://fortiguard.fortinet.com/psirt/FG-IR-26-277
Source: HKCERT (CC BY 3.0 HK) · HKCERT rating: medium, BSI WID Portal, BSI CSAF
Included in the same advisory
| High | CVE-2026-26248 | Fortinet FortiSandbox: Cross-site Scripting | 8.8 | — |
| Critical | CVE-2026-126263 | Fortinet FortiMail: SQL Injection | 9.4 | — |
| Critical | CVE-2026-126262 | Fortinet FortiAnalyzer: SQL Injection | 9.3 | — |
| Critical | CVE-2026-126261 | Fortinet FortiManager: Improper Authorization | 9.8 | — |
| Critical | CVE-2026-126259 | Fortinet FortiOS: Missing Authentication for Critical Function | 9.0 | — |
| High | CVE-2026-126258 | Fortinet FortiOS: Stack-based Buffer Overflow | 7.1 | — |
| Critical | CVE-2026-126257 | Fortinet FortiAuthenticator: Use of Hard-coded Password | 9.0 | — |
| High | CVE-2026-126256 | Fortinet FortiOS: Out-of-bounds Read | 7.4 | — |
| High | CVE-2026-126255 | Fortinet FortiOS: Path Traversal: '../filedir' | 7.4 | — |
| Critical | CVE-2026-126254 | Fortinet FortiOS: Numeric Truncation Error | 9.6 | — |
| Critical | CVE-2026-126253 | Fortinet FortiOS: Authentication Bypass by Primary Weakness | 9.3 | — |
| High | CVE-2026-126252 | Fortinet FortiAuthenticator: SQL Injection | 8.3 | — |
| Critical | CVE-2026-126251 | Fortinet FortiAuthenticator: Incorrect Authorization | 9.1 | — |
| High | CVE-2026-126250 | Fortinet FortiAuthenticator: Incorrect Authorization | 8.2 | — |
| High | CVE-2026-126249 | Fortinet FortiAuthenticator: Improper Privilege Management | 7.2 | — |
| High | CVE-2026-126248 | Fortinet FortiAuthenticator: Insufficiently Protected Credentials | 7.5 | — |
| High | CVE-2026-126247 | Fortinet FortiAuthenticator: Use of Externally-Controlled Format String | 7.2 | — |
| High | CVE-2026-126246 | Fortinet FortiAuthenticator: NULL Pointer Dereference | 7.5 | — |
| High | CVE-2026-126245 | Fortinet FortiAuthenticator: Out-of-bounds Write | 8.1 | — |
| High | CVE-2026-126244 | Fortinet FortiAuthenticator: Allocation of Resources Without Limits or Throttling | 7.5 | — |
| High | CVE-2026-126242 | Fortinet FortiAuthenticator: Incorrect Authorization | 7.4 | — |
| High | CVE-2026-126241 | Fortinet FortiAuthenticator: SQL Injection | 8.8 | — |
| High | CVE-2026-126240 | Fortinet FortiAuthenticator: LDAP Injection | 8.2 | — |
| High | CVE-2026-126239 | Fortinet FortiAuthenticator: Stack-based Buffer Overflow | 7.5 | — |
Show 64 more CVEs
| High | CVE-2026-126238 | Fortinet FortiAuthenticator: Incorrect Authorization | 8.6 | — |
| High | CVE-2026-126237 | Fortinet FortiAuthenticator: Infinite Loop | 7.5 | — |
| High | CVE-2026-126236 | Fortinet FortiManager Cloud: OS Command Injection | 7.2 | — |
| High | CVE-2026-126235 | Fortinet FortiAnalyzer Cloud: Path Traversal | 7.2 | — |
| High | CVE-2026-126234 | Fortinet FortiManager Cloud: Improper Neutralization of Special Elements Used in a Template Engine | 7.2 | — |
| High | CVE-2026-126233 | Fortinet FortiManager Cloud: Unrestricted Upload of File with Dangerous Type | 7.2 | — |
| High | CVE-2026-126232 | Fortinet FortiAnalyzer Cloud: Improper Certificate Validation | 7.5 | — |
| High | CVE-2026-126231 | Fortinet FortiManager Cloud: OS Command Injection | 7.2 | — |
| High | CVE-2026-126230 | Fortinet FortiAnalyzer Cloud: Use of Externally-Controlled Format String | 7.2 | — |
| Critical | CVE-2026-126229 | Fortinet FortiManager Cloud: Authorization Bypass Through User-Controlled Key | 9.1 | — |
| High | CVE-2026-126228 | Fortinet FortiManager Cloud: Out-of-bounds Write | 7.2 | — |
| High | CVE-2026-126227 | Fortinet FortiManager Cloud: Confused Deputy | 7.2 | — |
| High | CVE-2026-126226 | Fortinet FortiManager Cloud: OS Command Injection | 7.2 | — |
| High | CVE-2026-126225 | Fortinet FortiManager Cloud: Missing Authorization | 7.1 | — |
| High | CVE-2026-126224 | Fortinet FortiAnalyzer Cloud: Argument Injection | 7.2 | — |
| High | CVE-2026-126223 | Fortinet FortiManager Cloud: Stack-based Buffer Overflow | 7.2 | — |
| High | CVE-2026-126222 | Fortinet FortiManager Cloud: Path Traversal | 7.2 | — |
| High | CVE-2026-126219 | Fortinet FortiAnalyzer Cloud: Path Traversal | 7.2 | — |
| High | CVE-2026-126218 | Fortinet FortiManager: Authorization Bypass Through User-Controlled Key | 8.2 | — |
| High | CVE-2026-126214 | Fortinet FortiAnalyzer Cloud: Authentication Bypass by Spoofing | 8.7 | — |
| High | CVE-2026-126213 | Fortinet FortiManager Cloud: SQL Injection | 7.1 | — |
| High | CVE-2026-126212 | Fortinet FortiManager Cloud: Heap-based Buffer Overflow | 7.2 | — |
| High | CVE-2026-126211 | Fortinet FortiManager Cloud: Improper Privilege Management | 7.2 | — |
| High | CVE-2026-126185 | Fortinet FortiManager Cloud: Code Injection | 7.2 | — |
| High | CVE-2026-126184 | Fortinet FortiManager Cloud: Authentication Bypass by Spoofing | 8.2 | — |
| High | CVE-2026-126183 | Fortinet FortiManager Cloud: Authorization Bypass Through User-Controlled Key | 8.7 | — |
| High | CVE-2026-126182 | Fortinet FortiManager Cloud: Code Injection | 7.2 | — |
| High | CVE-2026-126181 | Fortinet FortiManager: Use of Hard-coded Credentials | 8.0 | — |
| High | CVE-2026-126180 | Fortinet FortiManager Cloud: Improper Neutralization of Special Elements Used in a Template Engine | 8.4 | — |
| High | CVE-2026-126179 | Fortinet FortiManager Cloud: OS Command Injection | 7.2 | — |
| High | CVE-2026-126178 | Fortinet FortiManager Cloud: Heap-based Buffer Overflow | 7.2 | — |
| High | CVE-2026-126176 | Fortinet FortiAnalyzer Cloud: XML Injection (aka Blind XPath Injection) | 8.1 | — |
| High | CVE-2026-126175 | Fortinet FortiAnalyzer Cloud: SQL Injection | 8.8 | — |
| High | CVE-2026-126171 | Fortinet FortiManager Cloud: Use of Externally-Controlled Format String | 7.2 | — |
| Critical | CVE-2026-126170 | Fortinet FortiManager Cloud: Improper Encoding or Escaping of Output | 9.8 | — |
| High | CVE-2026-126166 | Fortinet FortiMail: Argument Injection | 7.6 | — |
| High | CVE-2026-126165 | Fortinet FortiMail: Memory Allocation with Excessive Size Value | 7.5 | — |
| Critical | CVE-2026-126164 | Fortinet FortiMail: SQL Injection | 9.4 | — |
| High | CVE-2026-126163 | Fortinet FortiMail: Use of Externally-Controlled Format String | 8.1 | — |
| High | CVE-2026-126162 | Fortinet FortiMail: XML Injection (aka Blind XPath Injection) | 8.7 | — |
| High | CVE-2026-126161 | Fortinet FortiMail: Uncontrolled Resource Consumption | 7.5 | — |
| High | CVE-2026-126160 | Fortinet FortiMail: Improper Authentication | 8.2 | — |
| High | CVE-2026-126159 | Fortinet FortiMail: Authorization Bypass Through User-Controlled Key | 7.5 | — |
| High | CVE-2026-126158 | Fortinet FortiMail: OS Command Injection | 7.2 | — |
| Critical | CVE-2026-126157 | Fortinet FortiMail: Improper Authentication | 9.1 | — |
| Critical | CVE-2026-126156 | Fortinet FortiMail: Authorization Bypass Through User-Controlled Key | 9.1 | — |
| Critical | CVE-2026-126155 | Fortinet FortiMail: Incorrect Authorization | 9.1 | — |
| High | CVE-2026-126154 | Fortinet FortiMail: Out-of-bounds Write | 7.5 | — |
| High | CVE-2026-126153 | Fortinet FortiMail: Path Traversal | 7.5 | — |
| High | CVE-2026-126152 | Fortinet FortiMail: Authorization Bypass Through User-Controlled Key | 8.1 | — |
| High | CVE-2026-126151 | Fortinet FortiMail: Incorrect Implementation of Authentication Algorithm | 7.5 | — |
| Critical | CVE-2026-126150 | Fortinet FortiMail: Weak Password Recovery Mechanism for Forgotten Password | 9.1 | — |
| High | CVE-2026-126149 | Fortinet FortiMail: Integer Overflow or Wraparound | 7.5 | — |
| Critical | CVE-2026-126148 | Fortinet FortiMail: OS Command Injection | 9.8 | — |
| Critical | CVE-2026-126147 | Fortinet FortiMail: Path Traversal | 9.8 | — |
| High | CVE-2026-126146 | Fortinet FortiMail: OS Command Injection | 7.2 | — |
| High | CVE-2026-126145 | Fortinet FortiMail: OS Command Injection | 7.2 | — |
| High | CVE-2026-126144 | Fortinet FortiMail: OS Command Injection | 8.8 | — |
| Medium | CVE-2026-121530 | Fortinet FortiOS: Improper Authentication | 6.6 | — |
| Critical | CVE-2026-121529 | Fortinet FortiClientMac: Origin Validation Error | 9.1 | — |
| High | CVE-2026-121528 | Fortinet FortiOS: Improper Certificate Validation | 7.7 | — |
| Medium | CVE-2026-121527 | Fortinet FortiClientEMS: Execution with Unnecessary Privileges | 6.3 | — |
| Medium | CVE-2026-121526 | Fortinet FortiAuthenticator: Open Redirect | 5.8 | — |
| High | CVE-2025-61625 | Fortinet FortiManager Cloud: Path Traversal | 8.1 | — |
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2026-126260"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-126260.svg?lang=en" alt="CVE-2026-126260 – NEOSEC Intel" height="20"></a>