PT-2026-87171 · Fortinet · Fortisandbox+2

CVE-2026-26084

·

Publicado

2026-09-08

·

Atualizado

2026-09-10

CVSS v3.1

9.9

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
🚨Critical - Fortinet FortiSandbox Improper Access Control Info Leak (CVE-2026-26084)
Fortinet FortiSandbox (incl. FortiSandbox Cloud/PaaS) has improper access control in its HTTP handling, allowing unauthenticated attackers to send crafted HTTP requests to access sensitive information remotely. No privileges or user interaction required.
👉Affected / Fixed:
  • FortiSandbox 5.0.0-5.0.5 → 5.0.6
  • FortiSandbox 4.4.0-4.4.8 → 4.4.9
  • FortiSandbox 4.2.1-4.2.8 → no fix available
  • FortiSandbox Cloud 5.0.4-5.0.5 → 5.0.6
  • FortiSandbox PaaS 5.0.4-5.0.5 → 5.0.6

Correção

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-26084

Produtos afetados

Fortisandbox
Fortisandbox Cloud
Fortisandbox Paas