cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Fortinet Patches Critical RCE Flaws in FortiAuthenticator and FortiSandbox

· Original article ↗

Summary

Fortinet patched two critical flaws that could let unauthenticated attackers execute commands or code in FortiAuthenticator and FortiSandbox. FortiAuthenticator Cloud is not affected; the flaws were not reported as exploited in the wild.

Key points

  • CVE-2026-44277 is an improper access control flaw in FortiAuthenticator that may allow unauthenticated code or command execution via crafted requests.
  • FortiAuthenticator fixes are available in versions 6.5.7, 6.6.9, and 8.0.3; FortiAuthenticator Cloud is not affected.
  • CVE-2026-26083 is a missing authorization flaw that may allow unauthenticated code or command execution via HTTP requests.
  • FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS Web UI are affected by CVE-2026-26083.
  • Fortinet did not identify either flaw as exploited in the wild.

Article Details

Vulnerability Types
  • Improper access control
  • Missing authorization
Severity
Critical
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationCVE-2026-44277 could allow unauthenticated command or code execution in FortiAuthenticator via crafted requests; CVE-2026-26083 could allow unauthenticated command or code execution in FortiSandbox web interfaces via HTTP requests.

CVE

CVE-2026-26083Fortinet · Fortisandbox; Fortinet · Fortisandbox cloud; +1 moreFortinet has issued patches for two critical flaws, CVE-2026-44277 in FortiAuthenticator and CVE-2026-26083 in FortiSandbox, both of which could let unauthenticated attackers execute unauthorized commands or code.CVE-2026-44277Fortinet · FortiAuthenticatorFortinet has issued patches for two critical flaws, CVE-2026-44277 in FortiAuthenticator and CVE-2026-26083 in FortiSandbox, both of which could let unauthenticated attackers execute unauthorized commands or code.

Vendors

FortinetFortinet has issued patches for two critical flaws, CVE-2026-44277 in FortiAuthenticator and CVE-2026-26083 in FortiSandbox, both of which could let unauthenticated attackers execute unauthorized commands or code.

Products

FortiAuthenticatorFortinet has issued patches for two critical flaws, CVE-2026-44277 in FortiAuthenticator and CVE-2026-26083 in FortiSandbox, both of which could let unauthenticated attackers execute unauthorized commands or code.FortiSandboxFortinet has issued patches for two critical flaws, CVE-2026-44277 in FortiAuthenticator and CVE-2026-26083 in FortiSandbox, both of which could let unauthenticated attackers execute unauthorized commands or code.

Related Articles