CVE-2026-26083: Fortinet FortiSandbox

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Affected products

• Fortinet FortiSandbox: from 4.4.0, before 4.4.9 (fixed in 4.4.9); from 5.0.0, before 5.0.2 (fixed in 5.0.2)
• Fortinet FortiSandbox Cloud: from 5.0.2, before 5.0.6 (fixed in 5.0.6); from 23.1.4245, up to and including 23.4.4374; version 24.1.4436 only
• Fortinet FortiSandbox Paas: from 4.4.5, before 4.4.9 (fixed in 4.4.9); from 5.0.0, before 5.0.2 (fixed in 5.0.2); from 21.3.4055, up to and including 23.4.4374

Published 2026-05-12. Last modified 2026-07-08.