CVE-2026-26083

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.73%
EPSS Percentile: 54.35%
CISA KEV: Not listed

Description

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 13-May-2026 01:16
Last Modified: 27-Oct-2026 01:10
EPSS Date: 2026-10-30
CWE: CWE-862

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

fortinet / fortisandbox Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.4.0 · before (exclusive) 4.4.9
cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
fortinet / fortisandbox Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0.0 · before (exclusive) 5.0.2
cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
fortinet / fortisandbox_cloud Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0.2 · before (exclusive) 5.0.6
cpe:2.3:a:fortinet:fortisandbox_cloud:*:*:*:*:*:*:*:*
fortinet / fortisandbox_cloud Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 23.1.4245 · through (inclusive) 23.4.4374
cpe:2.3:a:fortinet:fortisandbox_cloud:*:*:*:*:*:*:*:*
fortinet / fortisandbox_cloud Source: NVD CPE · affected
Version / affected range: 24.1.4436
cpe:2.3:a:fortinet:fortisandbox_cloud:24.1.4436:*:*:*:*:*:*:*
fortinet / fortisandbox_paas Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.4.5 · before (exclusive) 4.4.9
cpe:2.3:a:fortinet:fortisandbox_paas:*:*:*:*:*:*:*:*
fortinet / fortisandbox_paas Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0.0 · before (exclusive) 5.0.2
cpe:2.3:a:fortinet:fortisandbox_paas:*:*:*:*:*:*:*:*
fortinet / fortisandbox_paas Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 21.3.4055 · through (inclusive) 23.4.4374
cpe:2.3:a:fortinet:fortisandbox_paas:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 31-Oct-2026 06:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

#Fortinet FortiSandbox Flaws Reportedly Exploited as Fortinet Releases Patches
Fortinet has issued patches for two critical flaws, CVE-2026-44277 in FortiAuthenticator and CVE-2026-26083 in FortiSandbox, both of which could let unauthenticated attackers execute unauthorized commands or code. Fortinet Patches Critical RCE Flaws in FortiAuthenticator and FortiSandbox

CVE (6)

MITRE ATT&CK (2)

Vendors (1)

Products (3)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.