CVE-2026-26083: Fortinet FortiSandbox Missing Authorization Vulnerability
CVE-2026-26083 is a missing authorization flaw (CWE-862) in several Fortinet FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS release lines, which the description says may let an unauthenticated remote attacker execute unauthorized code or commands over HTTP. The record reports a base score of 9.8 from Fortinet's PSIRT, a second score of 9.1, and no fixed versions, and no confirmed exploitation appears in the sources consulted. Administrators should check the vendor advisory and prioritize patching or restricting access to the affected interfaces.
Overview
CVE-2026-26083 is a missing authorization vulnerability (CWE-862) reported for several Fortinet FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS release lines. According to the description, an unauthenticated attacker may reach functionality that should be protected and execute unauthorized code or commands through HTTP requests. The vendor reference is Fortinet PSIRT advisory FG-IR-26-136.
Impact
- The description states that an unauthenticated remote attacker may execute unauthorized code or commands.
- The scores associated with the record place the issue in the critical range: 9.8 from Fortinet's PSIRT and 9.1 from a second provider listed as fortinet.
- The SSVC data in the record rates the technical impact as total and the issue as automatable, which indicates potential for severe impact if the flaw is abused.
Affected products and versions
- FortiSandbox: the description covers 5.0.0 through 5.0.1 and 4.4.0 through 4.4.8. The structured data also expresses ranges ending before 5.0.2 and before 4.4.9, and lists 4.2.1 through 4.2.8, which the narrative does not mention.
- FortiSandbox Cloud: the description covers 5.0.2 through 5.0.5. The structured data also lists 5.0.0 through 5.0.1, 4.4.5 through 4.4.8, a range ending before 5.0.6, the build 24.1.4436, and a range from 23.1.4245 to 23.4.4374.
- FortiSandbox PaaS: the description lists the branches 23.4, 23.3, 23.1, 22.2, 22.1, 21.4 and 21.3 as all versions, plus 5.0.0 through 5.0.1 and 4.4.5 through 4.4.8. The structured data also includes a range from 21.3.4055 to 23.4.4374 and a range ending before 4.4.9.
- The record contains no fix entries, so the exact patched build for each product line must be confirmed in the vendor advisory.
Exploitation status
- The CISA KEV entry in the record is marked as not listed, so this analysis does not state that the flaw is exploited in the wild.
- No confirmed exploitation appears in the sources consulted.
- The SSVC exploitation field is none. The recorded EPSS probability is 0.00498 with a percentile of 0.41824.
Remediation and mitigation
- Review vendor advisory FG-IR-26-136 and inventory which FortiSandbox, FortiSandbox Cloud or PaaS builds are in use.
- Apply the fixed release that Fortinet recommends for each affected product line. For cloud or PaaS services, follow the provider's maintenance guidance.
- Until patching is complete, limit who can reach administrative and web interfaces, keep them on trusted network segments behind access controls, and avoid direct exposure to the internet.
- After updating, confirm that the running version matches the fixed build stated by the vendor.
Detection guidance
- Review HTTP access logs for requests to management or web interfaces from unexpected sources, unusual request volume, or requests that succeed without a valid session.
- Look for unexpected configuration changes, new administrative accounts, or unfamiliar processes on the appliance.
- Correlate appliance logs with network telemetry and alert on access from outside approved management networks.
Limitations of the available information
- The record has no title, no fixed-version list, and no fix entries.
- The structured affected data contains overlapping and partly inconsistent ranges, so the vendor advisory should be treated as the authority.
- The sources consulted do not describe exploitation activity, and this analysis provides no technical exploit details.
Frequently asked questions
Does this CVE require authentication to exploit?
According to the description, the issue may be reachable by an unauthenticated attacker through HTTP requests. Organizations should treat the exposure as serious and check whether management or web interfaces are reachable from untrusted networks.
Is there a confirmed fixed version in the record?
No. The record contains no fix entries, so the patched build for each affected product line must be confirmed in Fortinet advisory FG-IR-26-136.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.