Routing protocols define which networks routers believe in. When an authentication check fails open, the routing plane can become an access-control problem. The GitHub Advisory Database describes CVE-2026-126253 as an authentication bypass in the OSPF daemon of Fortinet FortiOS.
The affected release ranges listed in the advisory are FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13. The description says an unauthenticated attacker may broadcast a Link State Advertisement through a specially crafted request.
What an LSA controls
OSPF routers exchange Link State Advertisements to describe topology and reachable prefixes. A device that accepts forged routing information can change its forwarding decisions, advertise a route that leads to the wrong host or create a denial of service.
The advisory summary does not provide a complete exploit chain, so defenders should not assume every forged packet succeeds against every configuration. The important fact is the missing authentication boundary: a crafted request can reach LSA handling without the attacker proving the routing protocol identity that the configuration expects.
This is different from an HTTP login bypass. The attacker does not need a web session. Reachability to the relevant routing interface and protocol behavior determine whether the issue is exposed. An internet-facing OSPF adjacency is unusual, but service-provider links, internal transit segments, lab networks and flat management networks can still expose the daemon to untrusted peers.
Router impact
A forged route can redirect traffic, break reachability or send traffic into a segment the attacker controls. Availability loss can affect VPN users, branch offices and firewall policy enforcement. A route change may also alter the path through which logs and management traffic travel.
The impact is not proof that a firewall policy has been bypassed. It is proof that the network's forwarding state can become untrustworthy. Incident response therefore needs router configuration, neighbor state, route table history and packet captures from the relevant segment.
Checks for defenders
Inventory FortiOS versions against the four affected branches. Identify interfaces with OSPF enabled, their neighbors and the authentication settings in use. Review whether OSPF is present on any interface reachable from a less-trusted zone.
Compare current routes and neighbor adjacencies with configuration backups and known-good topology. Look for unexpected prefix advertisements, adjacency changes and configuration edits near the incident window. Capture the routing control plane only within the organization's authorization and monitoring rules.
Apply the Fortinet fix identified in FG-IR-26-267 or a later vendor-supported release. Where a change must wait, remove OSPF from untrusted interfaces, add protocol filtering at the network boundary and reduce the set of devices that can form an adjacency.
Recovery questions
If forged routing state was accepted, confirm whether traffic reached an unintended next hop. Review firewall logs, VPN logs and flow records for paths that changed during the incident. Check whether the attacker used the route only to disrupt traffic or to establish a longer-lived position through a reachable service.
The advisory does not state that exploitation occurred. Treat that as an open question until the organization has evidence from its own devices.