FortinetCVE-2026-26084
Fortinet FortiSandbox: improper access control
Critical9.9CVE-2026-26084 · Published Sep 8, 2026
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiSandbox Product | >= 5.0.0, <= 5.0.5 | No fix yet |
| >= 4.4.0, <= 4.4.8 | No fix yet | |
| >= 4.2.1, <= 4.2.8 | No fix yet | |
| FortiSandbox Cloud Product | >= 5.0.4, <= 5.0.5 | No fix yet |
| FortiSandbox PaaS Product | >= 5.0.4, <= 5.0.5 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-284
More Fortinet advisories
All Fortinet| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 8 | Fortinet FortiSOAR PaaS: improper access control | Medium5.4 | No fix yet |
| Sep 8 | Fortinet FortiClientWindows: improper access control | Medium5.1 | No fix yet |
| Sep 8 | Fortinet FortiSandbox: command injection | High7.2 | No fix yet |
| Sep 8 | Fortinet FortiSIEM: open redirect | Low3.1 | No fix yet |
| Sep 8 | Fortinet FortiAnalyzer: denial of service | Medium6.5 | No fix yet |
| Sep 8 | Fortinet FortiOS: null pointer dereference | Low2.7 | No fix yet |