Is CVE-2026-26083 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26083 being exploited in the wild.

How severe is CVE-2026-26083?

Critical severity, with a CVSS score of 9.8, published 12 May 2026.

Which products and versions are affected?

Fortinet FortiSandbox 5.0.0 through 5.0.1, 4.4.0 through 4.4.8, 5.0.0 through 5.0.1, 4.4.0 through 4.4.8, 4.2.1 through 4.2.8; Fortinet FortiSandbox PaaS 21.3 through 23.4, 5.0.0 through 5.0.1, 4.4.5 through 4.4.8, 23.4, 23.3, 23.1, 22.2, 22.1, 21.4, 21.3, 5.0.0 through 5.0.1, 4.4.5 through 4.4.8; Fortinet Fortisandbox Cloud 5.0.2 through 5.0.5, 23.x, 24.x.

Is there a fix for CVE-2026-26083?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26083 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-26083?

Check whether you run Fortinet FortiSandbox, Fortinet FortiSandbox PaaS or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26083: Fortinet FortiSandbox missing authorization in Web UI

CVE-2026-26083 · Severity: critical · CVSS 9.8 · Published 2026-05-12

Fortinet FortiSandbox is a security solution used to identify and isolate advanced threats by analyzing suspicious files in a safe environment. A critical security flaw in its web management interface allows an unauthenticated attacker to remotely execute unauthorized commands. This could lead to a complete takeover of the sandbox system, potentially allowing attackers to bypass security inspections or gain a foothold in the corporate network.

Technologies: Fortinet FortiSandbox, Fortinet FortiSandbox PaaS, Fortinet Fortisandbox Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-26083 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26083 being exploited in the wild.
How severe is CVE-2026-26083?: Critical severity, with a CVSS score of 9.8, published 12 May 2026.
Which products and versions are affected?: Fortinet FortiSandbox 5.0.0 through 5.0.1, 4.4.0 through 4.4.8, 5.0.0 through 5.0.1, 4.4.0 through 4.4.8, 4.2.1 through 4.2.8; Fortinet FortiSandbox PaaS 21.3 through 23.4, 5.0.0 through 5.0.1, 4.4.5 through 4.4.8, 23.4, 23.3, 23.1, 22.2, 22.1, 21.4, 21.3, 5.0.0 through 5.0.1, 4.4.5 through 4.4.8; Fortinet Fortisandbox Cloud 5.0.2 through 5.0.5, 23.x, 24.x.
Is there a fix for CVE-2026-26083?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26083 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-26083?: Check whether you run Fortinet FortiSandbox, Fortinet FortiSandbox PaaS or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the Web UI component of Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. The flaw allows a remote, unauthenticated attacker to send crafted HTTP requests to the management interface to execute unauthorized code or system commands. The vulnerability stems from incorrect global authorization checks within the GUI. Successful exploitation grants the attacker full control over the affected appliance or cloud instance. Fortinet has released updates (e.g., 5.0.2, 4.4.9, 5.0.6) to address the issue.

Affected products

Fortinet FortiSandbox 5.0.0 through 5.0.1, 4.4.0 through 4.4.8, 4.2.1 through 4.2.8
Fortinet FortiSandbox Cloud 5.0.2 through 5.0.5, 23.x, 24.x
Fortinet FortiSandbox PaaS 21.3 through 23.4, 5.0.0 through 5.0.1, 4.4.5 through 4.4.8

Timeline

2026-05-12: disclosed: Initial publication by Fortinet
2026-05-12: advisory: FortiGuard Labs advisory FG-IR-26-136 published

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-136

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.