Vulnerability intelligence
CVE-2026-26083
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.
CVSS Score
9.1
Critical
EPSS — Exploit Probability
0.7%
Riskier than 51% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
3 articles across 3 outlets · first covered May 13, 2026 · latest May 18, 2026
Coverage timeline
-
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flawsthehackernews.com · May 18, 2026
-
Fortinet and Ivanti patch 18 flaws, including three critical bugswww.securityweek.com · May 13, 2026
-
Fortinet patches critical RCE flaws in FortiAuthenticator, FortiSandboxsecurityaffairs.com · May 13, 2026