CVEFinder.io

CVE-2026-26083

⛔ critical
🔍 Scan for this CVE
Summary

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may al

Description

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

CVSS Score
9.8
Critical
EPSS Score
0.1
Exploit Probability
Published Date
2026-05-12
First Seen: 2026-05-17
📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.4% of all 321,566 vulnerabilities in our database.

#30,777
Top 10% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 12, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-05-15
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-862

📦 Affected Products 5

Vendor Product Status Affected Versions
fortinet fortisandbox Affected
> 4.4.0 < 4.4.9
fortinet fortisandbox Affected
> 5.0.0 < 5.0.2
fortinet fortisandbox_cloud Affected
> 23.1.4245 < 23.4.4374
fortinet fortisandbox_cloud Affected
> 5.0.2 < 5.0.6
fortinet fortisandbox_cloud Affected
v24.1.4436

🔗 References 1

https://fortiguard.fortinet.com/psirt/FG-IR-26-136
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-39808 ⛔ critical 9.8 0.3 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F... 2026-04-14
CVE-2026-39812 🔶 medium 4.8 0.0 A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSa... 2026-04-14
CVE-2026-39813 ⛔ critical 9.8 0.1 A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.... 2026-04-14
CVE-2025-53608 🔶 medium 4.8 0.0 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerabi... 2026-03-10
CVE-2026-25836 ⚠️ high 7.2 0.1 An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet ... 2026-03-10
CVE-2025-52436 ⚠️ high 8.8 0.2 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerabi... 2026-02-10
These CVEs affect the same products