CVE-2026-26084

CriticalCVSS 9.9

Published: 08/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 08/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

An improper access control vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, Cloud 5.0.4 through 5.0.5, and PaaS 5.0.4 through 5.0.5 may allow an attacker to access sensitive information via crafted HTTP requests.

Risk Assessment

An attacker could access confidential data stored in FortiSandbox, potentially leading to information disclosure.

Recommendation

Upgrade FortiSandbox to the latest versions and monitor logs for unusual HTTP requests.

Other vulnerabilities in Fortinet FortiSandbox

CVE-2025-54353Medium
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, and 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.

Original NVD description (English source)

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS