CVE-2026-26084

critical · 9.9

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

9.9

CVSS

0.4%

EPSS (exploit prob.)

33rd

EPSS percentile

2026-09-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Weaknesses

CWE-284

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-166

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-26084