PT-2026-87171 · Fortinet · Fortisandbox+2

CVE-2026-26084

·

Published

2026-09-08

·

Updated

2026-09-10

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
🚨Critical - Fortinet FortiSandbox Improper Access Control Info Leak (CVE-2026-26084)
Fortinet FortiSandbox (incl. FortiSandbox Cloud/PaaS) has improper access control in its HTTP handling, allowing unauthenticated attackers to send crafted HTTP requests to access sensitive information remotely. No privileges or user interaction required.
👉Affected / Fixed:
  • FortiSandbox 5.0.0-5.0.5 → 5.0.6
  • FortiSandbox 4.4.0-4.4.8 → 4.4.9
  • FortiSandbox 4.2.1-4.2.8 → no fix available
  • FortiSandbox Cloud 5.0.4-5.0.5 → 5.0.6
  • FortiSandbox PaaS 5.0.4-5.0.5 → 5.0.6

Fix

Improper Access Control

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-26084

Affected Products

Fortisandbox
Fortisandbox Cloud
Fortisandbox Paas