FortiOS/FortiSASE OSPF daemon authentication bypass via crafted LSA

# FortiOS/FortiSASE OSPF daemon authentication bypass via crafted LSA

https://gcdradar.vercel.app/incidents/fortios-fortisase-ospf-daemon-authentication-bypass-via-craf · AIR-2026-1873 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical CVSS 9.3 disclosed vulnerability, no confirmed exploitation
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: No AI role
- Products: FortiOS, FortiSASE
- CVSS: 9.3

## Summary

An authentication bypass (CWE‑305) in the OSPF daemon of FortiOS and FortiSASE permits an unauthenticated attacker to broadcast LSAs using specially crafted requests. The vulnerability is assigned a CVSS v3 score of 9.3, indicating critical severity.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-10: Authentication bypass by primary weakness (https://fortiguard.fortinet.com/psirt/FG-IR-26-267)

## Sources

- 2026-11-10 Fortinet: Authentication bypass by primary weakness https://fortiguard.fortinet.com/psirt/FG-IR-26-267

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.