9.1 CriticalCWE-862
CVE-2026-26083
Fortinet FortiSandbox vulnerability
FortinetFortiSandbox
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
0.5%probability of exploitation in the next 30 days
Higher than 42% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 13 May · 07:20 UTC | Security Affairs | Fortinet patches critical RCE flaws in FortiAuthenticator, FortiSandbox |
| Wed 13 May · 09:49 UTC | SecurityWeek | Fortinet and Ivanti patch 18 flaws, including three critical bugs |
| Mon 18 May · 12:12 UTC | The Hacker News | Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws |
- Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation FlawsThe Hacker News · mentions it in passing
- Fortinet and Ivanti patch 18 flaws, including three critical bugsSecurityWeek · mentions it in passing
- Fortinet patches critical RCE flaws in FortiAuthenticator, FortiSandboxSecurity Affairs · first in our coverage · mentions it in passing