Is CVE-2026-59835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59835 being exploited in the wild.

How severe is CVE-2026-59835?

High severity, with a CVSS score of 8.6, published 14 July 2026.

Which products and versions are affected?

Fortinet FortiSandbox 5.0.0 through 5.0.2, 4.4.3 through 4.4.8.

Is there a fix for CVE-2026-59835?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59835 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59835?

Check whether you run Fortinet FortiSandbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59835: Fortinet FortiSandbox unauthenticated VNC access in scanning VMs

CVE-2026-59835 · Severity: high · CVSS 8.6 · Published 2026-07-14

A security vulnerability in Fortinet FortiSandbox could allow an unauthorized person to remotely view the screens of virtual machines used for malware analysis. FortiSandbox is a security tool that inspects suspicious files in isolated environments; this flaw could allow an attacker to observe sensitive scanning activities or potentially interact with the analysis environment. Organizations using affected versions should upgrade to the latest firmware to secure these interfaces.

Technologies: Fortinet FortiSandbox. Vendors: Fortinet.

Quick answers

Is CVE-2026-59835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59835 being exploited in the wild.
How severe is CVE-2026-59835?: High severity, with a CVSS score of 8.6, published 14 July 2026.
Which products and versions are affected?: Fortinet FortiSandbox 5.0.0 through 5.0.2, 4.4.3 through 4.4.8.
Is there a fix for CVE-2026-59835?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59835 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59835?: Check whether you run Fortinet FortiSandbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An 'Exposure of Resource to Wrong Sphere' vulnerability (CWE-668) exists in Fortinet FortiSandbox versions 5.0.0-5.0.2 and 4.4.3-4.4.8. The flaw allows unauthenticated VNC access to be exposed on all network interfaces. A remote attacker can exploit this by sending network requests to the VNC server of the virtual machines (VMs) currently performing file scanning. This could lead to unauthorized information disclosure or interaction with the sandboxed environment. The issue is resolved in FortiSandbox versions 5.0.3 and 4.4.9.

Affected products

Fortinet FortiSandbox 5.0.0 through 5.0.2, 4.4.3 through 4.4.8

Timeline

2026-07-14: disclosed
2026-07-14: advisory

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-145

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.