CVE-2021-26098: Fortinet FortiSandbox

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs.

Affected products

• Fortinet FortiSandbox: up to and including 3.1.4; from 3.2.0, before 3.2.3 (fixed in 3.2.3)

Published 2021-08-04. Last modified 2026-06-17.