CVE-2026-26083
published 2026-05-12CVE-2026-26083: A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.73%
50.6th percentile
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortisandbox | 4.2.1 – 4.2.8 | — |
| fortinet | fortisandbox | >= 4.4.0 < 4.4.9 | 4.4.9 |
| fortinet | fortisandbox | 4.4.0 – 4.4.8 | — |
| fortinet | fortisandbox | >= 5.0.0 < 5.0.2 | 5.0.2 |
| fortinet | fortisandbox | 5.0.0 – 5.0.1 | — |
| fortinet | fortisandbox_cloud | — | — |
| fortinet | fortisandbox_cloud | 23.1.4245 – 23.4.4374 | — |
| fortinet | fortisandbox_cloud | 4.4.5 – 4.4.8 | — |
| fortinet | fortisandbox_cloud | 5.0.0 – 5.0.1 | — |
| fortinet | fortisandbox_cloud | >= 5.0.2 < 5.0.6 | 5.0.6 |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | — | — |
| fortinet | fortisandbox_paas | 21.3.4055 – 23.4.4374 | — |
| fortinet | fortisandbox_paas | >= 4.4.5 < 4.4.9 | 4.4.9 |
| fortinet | fortisandbox_paas | 4.4.5 – 4.4.8 | — |
| fortinet | fortisandbox_paas | >= 5.0.0 < 5.0.2 | 5.0.2 |
| fortinet | fortisandbox_paas | 5.0.0 – 5.0.1 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector is unauthenticated HTTP requests targeting the FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI — monitor for anomalous unauthenticated HTTP requests to these management interfaces ↗
- →No authentication is required to trigger the vulnerability; alert on unauthenticated sessions reaching code-execution-capable endpoints on FortiSandbox web UI ↗
- ·Affected versions span FortiSandbox 5.0.0–5.0.1, FortiSandbox 4.4.0–4.4.8, FortiSandbox Cloud 5.0.2–5.0.5, FortiSandbox PaaS 21.3/21.4/22.1/22.2/23.1/23.3/23.4 (all versions), FortiSandbox PaaS 5.0.0–5.0.1, and FortiSandbox PaaS 4.4.5–4.4.8 — ensure version inventory is current before scoping detection ↗
- ·Fortinet has not confirmed active in-the-wild exploitation at time of advisory, but Fortinet vulnerabilities are historically targeted quickly — treat as high-priority patching candidate ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Critical Fortinet FortiSandbox flaws now exploited in attacks
blogs_bleepingcomputer·2026-06-16·CVSS 6.5
CVE-2026-39813 [MEDIUM] Critical Fortinet FortiSandbox flaws now exploited in attacks
## Critical Fortinet FortiSandbox flaws now exploited in attacks
## Sergiu Gatlan
Attackers are now exploiting several critical vulnerabilities in Fortinet's FortiSandbox cyber threat detection platform, according to threat intelligence company Defused.
Fortinet released security updates for these three critical-severity security flaws (tracked as CVE-2026-39813 , CVE-2026-39808 , and CVE-2026-25089 ) on April 14.
These flaws allow unauthenticated threat actors to escalate privileges and execute unauthorized code remotely through low-complexity command injection attacks that require no user interaction. To resolve these issues and block incoming attacks, admins must upgrade affected deployments to the latest released versions.
"We are observing exploitation of multiple Fortinet FortiS
Hackernews
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
blogs_hackernews·2026-05-18·CVSS 6.1
CVE-2026-42897 [MEDIUM] ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
Monday opens with a trust problem. A mail server flaw is under active use. A network control system was targeted. Trusted packages were poisoned. A fake model page pushed a stealer. Then came the familiar ransom claim: the data was returned and deleted.
The pattern is clear. One weak dependency can leak keys. One leaked key can open cloud access. One cloud foothold can become a production incident. AI is speeding up vulnerability discovery, attackers are moving quickly, and old exposure still keeps paying off.
Patch the quiet risks first. Let’s g
Hackernews
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
blogs_hackernews·2026-05-18·CVSS 9.8
CVE-2026-8043 [CRITICAL] Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Ivanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authentication and execute arbitrary code.
Topping the list is a critical flaw impacting Ivanti Xtraction (CVE-2026-8043, CVSS score: 9.6) that could be exploited to achieve information disclosure or client-side attacks.
"External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web
Bleepingcomputer
Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator
blogs_bleepingcomputer·2026-05-12·CVSS 9.8
CVE-2026-44277 [CRITICAL] Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator
## Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator
## Sergiu Gatlan
Fortinet has released security updates to address two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to run commands or arbitrary code on unpatched systems.
The first one, tracked as CVE-2026-44277, impacts the company's FortiAuthenticator Identity and Access Management (IAM) solution and was patched in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3.
"An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests," Fortinet said in a Tuesday advisory .
The company added that FortiAuthenticator Cloud (formerly known as FortiTrust Iden
2026-05-12
Published