Advisoriesby IbisFortinetCVE-2026-26084
Fortinet FortiSandbox: improper access control
No fix yet
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiSandbox Product | >= 5.0.0, <= 5.0.5 | No fix yet |
| >= 4.4.0, <= 4.4.8 | No fix yet | |
| >= 4.2.1, <= 4.2.8 | No fix yet | |
| FortiSandbox Cloud Product | >= 5.0.4, <= 5.0.5 | No fix yet |
| FortiSandbox PaaS Product | >= 5.0.4, <= 5.0.5 | No fix yet |
Changes since it was listed
Summary: A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, to A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSand
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-284