What’s Vulnerable › Vulnerabilities
CVE-2026-26083
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-12 · updated 2026-10-26
- Weakness: CWE-862
Description
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.
Affected products
- Fortinet FortiSandbox: from 4.4.0 before 4.4.9; from 5.0.0 before 5.0.2 — fixed in 4.4.9, 5.0.2
- Fortinet FortiSandbox Cloud: from 5.0.2 before 5.0.6; from 23.1.4245 through 23.4.4374; 24.1.4436 — fixed in 5.0.6
- Fortinet FortiSandbox PaaS: from 4.4.5 before 4.4.9; from 5.0.0 before 5.0.2; from 21.3.4055 through 23.4.4374 — fixed in 4.4.9, 5.0.2
How to fix
Upgrade to a fixed version: Fortinet FortiSandbox 4.4.9, 5.0.2; Fortinet FortiSandbox Cloud 5.0.6; Fortinet FortiSandbox PaaS 4.4.9, 5.0.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-26083 or the next vulnerability affects your stack