CVE-2026-26083

The vulnerability results from missing authorization verification for specific HTTP requests handled by FortiSandbox. An attacker without any credentials can send crafted HTTP requests directly to the vulnerable system, bypassing access control mechanisms. Due to the network attack vector (AV:N), lack of attack complexity requirements (AC:L), and no need for user interaction, exploitation can be performed remotely and fully automatically.

An unauthenticated attacker can remotely execute arbitrary code or system commands on the vulnerable device, leading to complete compromise of confidentiality, integrity, and availability of the system (C:H/I:H/A:H).

Apply patches available from the vendor according to references published by Fortinet at https://fortiguard.fortinet.com/psirt/FG-IR-26-136. Until patches are implemented, it is recommended to restrict network access to the FortiSandbox HTTP interface only to trusted IP addresses and isolate the device from public networks.

Fortinet FortiSandbox 5.0.0–5.0.1, FortiSandbox 4.4.0–4.4.8; FortiSandbox Cloud 5.0.2–5.0.5; FortiSandbox PaaS 23.4 (all versions), 23.3 (all versions), 23.1 (all versions), 22.2 (all versions), 22.1 (all versions), 21.4 (all versions), 21.3 (all versions), 5.0.0–5.0.1, 4.4.5–4.4.8