PT-2026-40115 · Fortinet · Fortisandbox Cloud+2

Published

2026-05-12

·

Updated

2026-06-09

·

CVE-2026-26083

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.0.0 through 5.0.1 FortiSandbox versions 4.4.0 through 4.4.8 FortiSandbox Cloud versions 5.0.2 through 5.0.5 FortiSandbox PaaS version 23.4 FortiSandbox PaaS version 23.3 FortiSandbox PaaS version 23.1 FortiSandbox PaaS version 22.2 FortiSandbox PaaS version 22.1 FortiSandbox PaaS version 21.4 FortiSandbox PaaS version 21.3 FortiSandbox PaaS versions 5.0.0 through 5.0.1 FortiSandbox PaaS versions 4.4.5 through 4.4.8
Description A missing authorization flaw allows an unauthenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests. This issue can lead to full system compromise and data theft.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07887
CVE-2026-26083

Affected Products

Fortisandbox
Fortisandbox Cloud
Fortisandbox Paas