FortiOS 7.6 flaw CVE-2026-121530 lets RADIUS admins sign in with an invalid two-factor token
The attacker still needs a valid administrator password, and only RADIUS setups that send a further challenge after a wrong token are exposed. Fortinet fixed two more FortiOS flaws the same day, and the fix for this one leaves both open.
Affects
Fortinet FortiOS
What to do
Upgrade FortiOS 7.6 devices to a fixed build, or delete remote RADIUS admin accounts until you can.
- Vendor advisory
- CVE
- CVE-2026-121530
- CVSS
- 5.9 (v3.1, Fortinet)
- Exploitation
- None known
- Affected
- Fortinet FortiOS
- FortiOS 7.6.0 through 7.6.6
- Fixed in
- FortiOS 7.6.7 or above
How the flaw works
Fortinet's advisory places the flaw in two-factor authentication for remote RADIUS administrator accounts in the FortiOS GUI. Fortinet says an attacker holding a valid username and password for an admin with at least read-only permission can sign in with an invalid token. It works only where the RADIUS server answers a failed token with a further Access-Challenge.
What to do now
Start with 7.6 FortiGates that have remote RADIUS administrators and an externally reachable GUI, because the attacker can be remote. Take them straight to 7.6.8: Fortinet's same-day advisories list 7.6.7 as still exposed to flaws in the OSPF and SSH daemons.
- List every FortiGate on 7.6 and the remote RADIUS administrator accounts on each
- Check whether each RADIUS server sends an additional Access-Challenge after an invalid token
- Where the upgrade must wait, delete those accounts under System > Administrators
- Upgrade along Fortinet's recommended path, using its upgrade tool
- Review admin sign-ins and configuration changes since each device took an affected build
Who is affected
Fortinet lists the 8.0, 7.4 and 7.2 branches as not affected, and its workaround names only Remote Radius Type administrator accounts.
The OSPF flaw fixed alongside affects the 8.0, 7.6, 7.4 and 7.2 branches; the SSH flaw applies only where GPC OS Login is enabled.
Detection notes
Fortinet reports no known exploitation. Abuse needs a working password, so compare each FortiGate admin sign-in with the RADIUS server's verdict on the token.
- GUI sign-ins by remote RADIUS admins where the RADIUS log shows a rejected token
- Admin sessions from addresses outside the usual management range
- Read-only admin accounts active at unusual hours or from new locations
- Lockouts or password resets on admin accounts nobody on the team requested
Essential Eight mapping
Patch applications and patch operating systems apply. Fortinet rates the OSPF daemon flaw fixed the same day as critical, which brings the Essential Eight Maturity Model's 48-hour window for internet-facing network devices into play. Multi-factor authentication and restrict administrative privileges limit what one stolen admin password reaches.
Sources
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
- SecondaryFortinet PSIRT, FG-IR-26-195 FortiOS: Broken Access Control in Two-Factor-Authentication (10 November 2026)Retrieved 12 Nov 2026
- SecondaryFortinet PSIRT, FG-IR-26-267 FortiOS: Authentication bypass by primary weakness (10 November 2026)Retrieved 12 Nov 2026
- SecondaryFortinet PSIRT, FG-IR-26-269 FortiOS: Improper neutralization of special elements in output used by a downstream component in sshd (10 November 2026)Retrieved 12 Nov 2026
