CVE-2026-26083

State: Published
Severity: 9.1 Critical
Published: May 12, 2026
Updated: Jul 8, 2026
Reserved: Feb 11, 2026

Description

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C	fortinet

Weaknesses

CWE-862 Execute unauthorized code or commands

Affected Products

Product	Versions
FortiSandboxFortinet	5.0.0 through 5.0.1Affected 4.4.0 through 4.4.8Affected 4.2.1 through 4.2.8Affected
FortiSandbox PaaSFortinet	23.4.4374Affected 23.4.4350Affected 23.3.4329Affected 23.1.4245Affected 22.2.4151Affected 22.2.4134Affected 22.1.4113Affected 21.4.4072Affected 21.3.4055Affected 5.0.0 through 5.0.1Affected 4.4.5 through 4.4.8Affected
FortiSandbox CloudFortinet	5.0.0 through 5.0.1Affected 4.4.5 through 4.4.8Affected

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-136

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.