CVE-2026-26083

critical · 9.8

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

9.8

CVSS

0.7%

EPSS (exploit prob.)

53rd

EPSS percentile

2026-05-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-862

Affected products

Vendor	Product	Affected versions
fortinet	fortisandbox	>= 4.4.0, < 4.4.9
fortinet	fortisandbox	>= 5.0.0, < 5.0.2
fortinet	fortisandbox_cloud	>= 5.0.2, < 5.0.6
fortinet	fortisandbox_cloud	>= 23.1.4245, <= 23.4.4374
fortinet	fortisandbox_cloud	24.1.4436
fortinet	fortisandbox_paas	>= 4.4.5, < 4.4.9
fortinet	fortisandbox_paas	>= 5.0.0, < 5.0.2
fortinet	fortisandbox_paas	>= 21.3.4055, <= 23.4.4374

Check a specific version with /api/v1/cve/match.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-136

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-26083