BugZero | Fortinet BugID 1215886 - Spoofed reply packets bypass FortiGate when strict...

Fortinet - Defect ID: 1215886

Fortinet Integration

Learn more about where this data comes from

Fortinet Integration

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Description

Spoofed reply packets bypass FortiGate when strict check is enabled and reply traffic comes from a different interface.

Change history

2026-04-21 Added: 8.0.0

8.0Defect ID: 1190878
Incorrect firewall.vip type=server-load-balance global limit in Max Values table
8.0Defect ID: 1198219
Packets are dropped when using auto-asic-offload with EMAC-VLAN over LACP on FortiGate
8.0Defect ID: 1203504
Traffic fails over emac-vlan interface between vdoms when offloading is enabled
8.0Defect ID: 1214413
The handling of "firewall-session-dirty check-all" has been optimized so that changes to interfaces or policies unrelated to the offloaded session will not cause the offloaded session to become dirty
8.0Defect ID: 1215886
Spoofed reply packets bypass FortiGate when strict check is enabled and reply traffic comes from a different interface