Fortinet's November advisories landed on 10 November, and the one that matters on a FortiGate boundary is an OSPF authentication bypass rated 9.3. No login is needed to make the firewall broadcast routing updates it should have rejected.
What happened
Advisory FG-IR-26-267 describes an authentication bypass by primary weakness in the FortiOS OSPF daemon. A specially crafted request is enough for an unauthenticated attacker to have the firewall send link-state advertisements to its OSPF neighbours.
The effect is route injection. Traffic that should follow one path can be pulled toward a next hop the attacker chooses, or blackholed entirely. On a hub and spoke network the forged advertisement can propagate past the first router, which is what makes it worth patching rather than waiting. Fortinet says the issue was not known to be exploited when the advisory was published, and credits its own product security team, working with an AI model, for the find.
Who is affected
Exposure depends on configuration as much as version. A FortiGate with OSPF disabled is not a target; one trading OSPF routes with branch firewalls or a core router is.
- FortiOS 8.0.0 through 8.0.1, fixed in 8.0.2
- FortiOS 7.6.0 through 7.6.7, fixed in 7.6.8
- FortiOS 7.4.0 through 7.4.12, fixed in 7.4.13
- FortiOS 7.2.0 through 7.2.13, fixed in 7.2.14
- FortiSASE 26.3.1, remediated server-side in 26.3.2
What to do now
Upgrade every FortiGate that runs OSPF to 7.2.14, 7.4.13, 7.6.8 or 8.0.2, and check both members of any HA pair before calling it done.
- Inventory first: list the firewalls where OSPF is actually configured, including units a reseller or MSP manages on your behalf.
- Keep the OSPF daemon off anything reachable from the internet, guest networks or DMZs. OSPF belongs on trusted internal interfaces only.
- Turn on OSPF authentication with MD5 or SHA on every neighbour pair so a forged LSA from an unknown speaker is dropped.
- After patching, compare the routing table and neighbour list against your baseline and alert on unexpected LSA churn.
What this means for South African businesses
FortiGate sits at the edge of a large share of SA SME networks, and OSPF tends to appear the moment a company has a second site or an IPsec hub, so the population at risk is bigger than the protocol's reputation suggests. A single flat office with static routes has close to zero exposure; a group with branch firewalls exchanging routes over IPsec does not.
My judgement is that this belongs in the next maintenance window rather than the next quarter, but it should not displace an actively exploited bug. The cheap half of the fix is free: if you cannot patch this week, restrict OSPF to trusted interfaces tonight.
Source: Fortinet PSIRT advisory FG-IR-26-267, published 10 November 2026.
Also on the blog
- Microsoft Outlook CVE-2026-124194: opening a message file hands over your NTLMv2 hash
- Windows Search CVE-2026-116928: CVSS 9.8 RCE with no credentials and no clicks
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.