CVE-2026-126255
A NVD · · CVE-2026-126255
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 7.4
- EPSS
- 0%
Key insight
Beyond the patch information, the CVE shows an unauthenticated authentication bypass in FortiOS/FortiPAM, making exposed management and remote-access interfaces particularly critical.
Description
CVE-2026-126255 is a path traversal vulnerability ('../filedir') in Fortinet FortiOS and FortiPAM. According to the description, an unauthenticated attacker can bypass authentication using specially crafted credentials. Affected are FortiOS versions from 7.2.0 through 8.0.1 as well as all listed FortiPAM versions. The alert does not contain indications of active exploitation, KEV inclusion, or a public PoC.
Risk score
- cvss base
- 74.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 74.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational