CVE-2026-26083 - Vulnerability Details

Description

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.0 through 5.0.1, FortiSandbox Cloud 4.4.5 through 4.4.8, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Published: 2026-05-12

Score: 9.1 Critical

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiSandbox

unaffected

Version	Status	Constraints
`5.0.0`	affected	≤ 5.0.1
`4.4.0`	affected	≤ 4.4.8
`4.2.1`	affected	≤ 4.2.8

Fortinet

FortiSandbox Cloud

unaffected

Version	Status	Constraints
`5.0.0`	affected	≤ 5.0.1
`4.4.5`	affected	≤ 4.4.8

Fortinet

FortiSandbox PaaS

unaffected

Version	Status	Constraints
`23.4.4374`	affected	—
`23.4.4350`	affected	—
`23.3.4329`	affected	—
`23.1.4245`	affected	—
`22.2.4151`	affected	—
`22.2.4134`	affected	—
`22.1.4113`	affected	—
`21.4.4072`	affected	—
`21.3.4055`	affected	—
`5.0.0`	affected	≤ 5.0.1
`4.4.5`	affected	≤ 4.4.8

Configuration 1 [-]

OR	cpe:2.3:a:fortinet:fortisandbox::::::::
	cpe:2.3:a:fortinet:fortisandbox::::::::
	cpe:2.3:a:fortinet:fortisandbox_cloud::::::::
	cpe:2.3:a:fortinet:fortisandbox_cloud::::::::
	cpe:2.3:a:fortinet:fortisandbox_cloud:24.1.4436:::::::*
	cpe:2.3:a:fortinet:fortisandbox_paas::::::::
	cpe:2.3:a:fortinet:fortisandbox_paas::::::::
	cpe:2.3:a:fortinet:fortisandbox_paas::::::::

No data.

Vendor Product Confidence Versions

Fortinet

Fortisandbox

90%

Version	Status	Scheme	Platform
`[5.0.0,5.0.1]`	affected	semver	—
`[4.4.0,4.4.8]`	affected	semver	—
`[4.2.1,4.2.8]`	affected	semver	—

Fortinet

Fortisandboxcloud

90%

Version	Status	Scheme	Platform
`[5.0.0,5.0.1]`	affected	semver	—
`[4.4.5,4.4.8]`	affected	semver	—

Fortinet

Fortisandboxpaas

90%

Version	Status	Scheme	Platform
`23.4.4374`	affected	generic	—
`23.4.4350`	affected	generic	—
`23.3.4329`	affected	generic	—
`23.1.4245`	affected	generic	—
`22.2.4151`	affected	generic	—
`22.2.4134`	affected	generic	—
`22.1.4113`	affected	generic	—
`21.4.4072`	affected	generic	—
`21.3.4055`	affected	generic	—
`[5.0.0,5.0.1]`	affected	semver	—
`[4.4.5,4.4.8]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Upgrade to FortiSandbox version 5.0.2 or above Upgrade to FortiSandbox version 4.4.9 or above Upgrade to FortiSandbox PaaS version 5.0.2 or above Upgrade to FortiSandbox PaaS version 4.4.9 or above Upgrade to FortiSandbox Cloud version 5.0.2 or above Upgrade to FortiSandbox Cloud version 4.4.9 or above

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00733.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://fortiguard.fortinet.com/psirt/FG-IR-26-136

History

Fri, 06 Nov 2026 19:45:00 +0000

Type	Values Removed	Values Added
Title	Unauthenticated Authorization Failure in FortiSandbox Allowing Remote Code Execution

Fri, 06 Nov 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description	A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.	A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.0 through 5.0.1, FortiSandbox Cloud 4.4.5 through 4.4.8, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Fri, 15 May 2026 13:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fortinet fortisandbox Cloud Fortinet fortisandbox Paas
CPEs		cpe:2.3:a:fortinet:fortisandbox:::::::: cpe:2.3:a:fortinet:fortisandbox_cloud:::::::: cpe:2.3:a:fortinet:fortisandbox_cloud:24.1.4436:::::::* cpe:2.3:a:fortinet:fortisandbox_paas::::::::
Vendors & Products		Fortinet fortisandbox Cloud Fortinet fortisandbox Paas

Tue, 12 May 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title		Unauthenticated Authorization Failure in FortiSandbox Allowing Remote Code Execution

Tue, 12 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 12 May 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.
First Time appeared		Fortinet Fortinet fortisandbox Fortinet fortisandboxcloud Fortinet fortisandboxpaas
Weaknesses		CWE-862
CPEs		cpe:2.3:a:fortinet:fortisandbox:4.2.1:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.2:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.3:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.4:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.5:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.6:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.7:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.8:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.0:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.1:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.2:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.3:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.4:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.5:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.6:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.7:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.8:::::::* cpe:2.3:a:fortinet:fortisandbox:5.0.0:::::::* cpe:2.3:a:fortinet:fortisandbox:5.0.1:::::::* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.5:::::::* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.6:::::::* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.7:::::::* cpe:2.3:a:fortinet:fortisandboxcloud:4.4.8:::::::* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:::::::* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.5:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.6:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.7:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:4.4.8:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.0:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.1:::::::*
Vendors & Products		Fortinet Fortinet fortisandbox Fortinet fortisandboxcloud Fortinet fortisandboxpaas
References		https://fortiguard.fortinet.com/psirt/FG-IR-26-136
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'}`

Subscriptions

Fortinet Fortisandbox Fortisandbox Cloud Fortisandbox Paas Fortisandboxcloud Fortisandboxpaas

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2026-05-12T16:54:04.923Z

Updated: 2026-11-06T15:42:12.865Z

Reserved: 2026-02-11T09:32:22.258Z

Link: CVE-2026-26083

Vulnrichment

Updated: 2026-05-12T19:03:01.340Z

NVD

Status : Modified

Published: 2026-05-12T18:16:39.817

Modified: 2026-11-06T16:18:01.000

Link: CVE-2026-26083

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-06T19:30:10Z

Weaknesses

CWE-862

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object