FortiSandbox auth bypass in 4.45.0.x series
CVE-2026-26083 Published on May 12, 2026
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.
Vulnerability Analysis
CVE-2026-26083 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-26083 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-26083
Want to know whenever a new CVE is published for Fortinet products? stack.watch will email you.
Affected Versions
Fortinet FortiSandbox Cloud:- Version 5.0.0, <= 5.0.1 is affected.
- Version 4.4.5, <= 4.4.8 is affected.
- Version 5.0.0, <= 5.0.1 is affected.
- Version 4.4.0, <= 4.4.8 is affected.
- Version 4.2.1, <= 4.2.8 is affected.
- Version 23.4.4374 is affected.
- Version 23.4.4350 is affected.
- Version 23.3.4329 is affected.
- Version 23.1.4245 is affected.
- Version 22.2.4151 is affected.
- Version 22.2.4134 is affected.
- Version 22.1.4113 is affected.
- Version 21.4.4072 is affected.
- Version 21.3.4055 is affected.
- Version 5.0.0, <= 5.0.1 is affected.
- Version 4.4.5, <= 4.4.8 is affected.