A FortiGate Title Count Cannot Prove OSPF Is Exposed
FortiGate devices are easy to count by product name. Routing protocol exposure is a different question. CVE-2026-126253 concerns OSPF Link State Advertisement handling, so a large title inventory is only a starting point.
The following count-only measurements used sub_type=all, page 1 and page size 1 on 2026-11-13 between 07:40 and 07:42 Asia/Shanghai.
| Query | Matching assets |
|---|---|
app="FortiOS" |
0 |
title="FortiGate" |
2,109,204 |
This is a large title surface. It does not mean 2,109,204 devices are running an affected OSPF configuration.
What ZoomEye observed
The exact application string did not match in this probe. The title query did. A product title can appear on a login page, management portal, documentation server or an asset that is not the routing device itself. Each result needs ownership and technology confirmation.
The OSPF issue is described in the GitHub advisory for CVE-2026-126253. Affected FortiOS branches include 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13. The weakness lets an unauthenticated attacker broadcast an LSA through a specially crafted request.
Combine external and internal views
Use the title count to locate organizational edge devices and management pages. Join those hosts to certificate ownership, ASN data, branch-network records and firewall inventories.
Then obtain the routing-plane facts from the devices or a configuration-management system. Record the FortiOS version, OSPF-enabled interfaces, neighbor authentication and the trust level of each segment.
The external search does not expose neighbor state or authentication configuration. Analysts should not mark a device vulnerable because its title contains FortiGate.
Review priority
Start with affected versions that run OSPF on any untrusted segment. Then review devices with OSPF on flat management or lab networks. Internet-facing management portals are an additional concern even when OSPF is not exposed on the same interface.
Check for unexpected neighbor adjacencies, prefix advertisements and route changes. Preserve route tables, configuration backups and flow logs before applying remediation that changes topology.
Remediation
Apply the Fortinet fix from FG-IR-26-267 or a later supported release. Until then, remove OSPF from untrusted interfaces, filter routing protocol traffic at the network boundary and limit which peers can form adjacencies.
Reporting rule
Report the exact ZoomEye query and total as an inventory observation. Report the vulnerable status only after checking the device version and OSPF configuration. Keep those states separate in dashboards and incident records.
Top comments (0)