CVE-2026-26083_CVE-2026-26083

9.1 / 10

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Description

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Basic Information

ID CVE-2026-26083

Source fortinet

Published May 12, 2026 at 16:54

Affected Product

Vendor Fortinet

Product FortiSandbox Cloud

Version 5.0.0

Affected Versions Fortinet FortiSandbox Cloud 5.0.0
Fortinet FortiSandbox Cloud 4.4.5
Fortinet FortiSandbox 5.0.0
Fortinet FortiSandbox 4.4.0
Fortinet FortiSandbox 4.2.1
Fortinet FortiSandbox PaaS 23.4.4374
Fortinet FortiSandbox PaaS 23.4.4350
Fortinet FortiSandbox PaaS 23.3.4329
Fortinet FortiSandbox PaaS 23.1.4245
Fortinet FortiSandbox PaaS 22.2.4151
Fortinet FortiSandbox PaaS 22.2.4134
Fortinet FortiSandbox PaaS 22.1.4113
Fortinet FortiSandbox PaaS 21.4.4072
Fortinet FortiSandbox PaaS 21.3.4055
Fortinet FortiSandbox PaaS 5.0.0
Fortinet FortiSandbox PaaS 4.4.5

CWE Classification

CWE-862

References

fortiguard.fortinet.com /psirt/FG-IR-26-136

{
    "lastseen": "",
    "description": "A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.",
    "published": "2026-05-12T16:54:04.923Z",
    "modified": "2026-05-12T16:54:04.923Z",
    "type": "cve",
    "title": "CVE-2026-26083",
    "source": "fortinet",
    "references": "https://fortiguard.fortinet.com/psirt/FG-IR-26-136",
    "id": "CVE-2026-26083",
    "bulletinFamily": "",
    "cwe": [
        "CWE-862"
    ],
    "cvelist": null,
    "sourceData": "Fortinet FortiSandbox Cloud 5.0.0\nFortinet FortiSandbox Cloud 4.4.5\nFortinet FortiSandbox 5.0.0\nFortinet FortiSandbox 4.4.0\nFortinet FortiSandbox 4.2.1\nFortinet FortiSandbox PaaS 23.4.4374\nFortinet FortiSandbox PaaS 23.4.4350\nFortinet FortiSandbox PaaS 23.3.4329\nFortinet FortiSandbox PaaS 23.1.4245\nFortinet FortiSandbox PaaS 22.2.4151\nFortinet FortiSandbox PaaS 22.2.4134\nFortinet FortiSandbox PaaS 22.1.4113\nFortinet FortiSandbox PaaS 21.4.4072\nFortinet FortiSandbox PaaS 21.3.4055\nFortinet FortiSandbox PaaS 5.0.0\nFortinet FortiSandbox PaaS 4.4.5",
    "sourceHref": "",
    "cvss": {
        "score": 9.1,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "FortiSandbox Cloud",
    "version": "5.0.0",
    "vendor": "Fortinet",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}