by Kastro
Paper/Archive/CVE-2026-26083

CVE-2026-26083

Fortinet FortiSandbox — A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud…

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 54.4.544 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Affected

ProductAffectedFixed inSource
FortiSandbox5.0.0 – 5.0.1–CNA
FortiSandbox4.4.0 – 4.4.8–CNA
FortiSandbox4.2.1 – 4.2.8–CNA
FortiSandbox PaaS23.4.4374–CNA
FortiSandbox PaaS23.4.4350–CNA
FortiSandbox PaaS23.3.4329–CNA
FortiSandbox PaaS23.1.4245–CNA
FortiSandbox PaaS22.2.4151–CNA
FortiSandbox PaaS22.2.4134–CNA
FortiSandbox PaaS22.1.4113–CNA
FortiSandbox PaaS21.4.4072–CNA
FortiSandbox PaaS21.3.4055–CNA

Scores by source

fortinet (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-26-136