FortiOS and FortiSASE OSPF flaw lets unauthenticated attackers send LSAs
Original title: Authentication bypass by primary weakness
Fortinet rates the CWE-305 weakness 9.3; the notice gives no versions, fix, or exploitation status.
Fortinet PSIRT revised FG-IR-26-267 on November 10, describing an authentication bypass by primary weakness in the OSPF daemon of FortiOS and FortiSASE. An unauthenticated attacker may broadcast LSAs with a specially crafted request. The notice states a CVSSv3 score of 9.3 and CWE-305, but no affected versions, fixed release, or exploitation status.
Unconfirmed: Affected versions, a fix, and whether the flaw is exploited are not stated.
- CVSSv3 score is 9.3; weakness is CWE-305.
- The issue is in the FortiOS and FortiSASE OSPF daemon.
- Impact described is broadcasting LSAs, not code execution.
- The advisory was revised on November 10, 2026.
Impact: Unauthenticated broadcast of OSPF link-state advertisements
| Product | Affected |
|---|---|
| Fortinet FortiOS | — |
| Fortinet FortiSASE | — |
From the original article
CVSSv3 Score: 9. 3 An Authentication Bypass by Primary Weakness vulnerability [cwe-305] in FortiOS and FortiSASE ospf daemon may allow an unauthenticated attacker to broadcast LSA via specially crafted request Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.