{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-26083", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-02-11T09:32:22.258Z", "datePublished": "2026-05-12T16:54:04.923Z", "dateUpdated": "2026-07-08T12:50:53.631Z" }, "containers": { "cna": { "affected": [ { "vendor": "Fortinet", "product": "FortiSandbox", "cpes": [ "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "5.0.0", "lessThanOrEqual": "5.0.1", "status": "affected" }, { "versionType": "semver", "version": "4.4.0", "lessThanOrEqual": "4.4.8", "status": "affected" }, { "versionType": "semver", "version": "4.2.1", "lessThanOrEqual": "4.2.8", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox PaaS", "cpes": [ "cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:4.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:4.4.5:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "version": "23.4.4374", "status": "affected" }, { "version": "23.4.4350", "status": "affected" }, { "version": "23.3.4329", "status": "affected" }, { "version": "23.1.4245", "status": "affected" }, { "version": "22.2.4151", "status": "affected" }, { "version": "22.2.4134", "status": "affected" }, { "version": "22.1.4113", "status": "affected" }, { "version": "21.4.4072", "status": "affected" }, { "version": "21.3.4055", "status": "affected" }, { "versionType": "semver", "version": "5.0.0", "lessThanOrEqual": "5.0.1", "status": "affected" }, { "versionType": "semver", "version": "4.4.5", "lessThanOrEqual": "4.4.8", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox Cloud", "cpes": [ "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxcloud:4.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxcloud:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxcloud:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxcloud:4.4.5:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "5.0.0", "lessThanOrEqual": "5.0.1", "status": "affected" }, { "versionType": "semver", "version": "4.4.5", "lessThanOrEqual": "4.4.8", "status": "affected" } ] } ], "descriptions": [ { "lang": "en", "value": "A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests." } ], "providerMetadata": { "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-07-08T12:50:53.631Z" }, "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-862", "description": "Execute unauthorized code or commands", "type": "CWE" } ] } ], "metrics": [ { "format": "CVSS", "cvssV3_1": { "version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C" } } ], "solutions": [ { "lang": "en", "value": "Fortinet remediated this issue in FortiSandbox Cloud version 5.0.2 and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSandbox Cloud version 4.4.9 and hence customers do not need to perform any action.\nUpgrade to FortiSandbox version 5.0.2 or above\nUpgrade to FortiSandbox version 4.4.9 or above\nUpgrade to FortiSandbox PaaS version 5.0.2 or above\nUpgrade to FortiSandbox PaaS version 4.4.9 or above" } ], "references": [ { "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-136", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-136" } ] }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-05-12T00:00:00+00:00", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-26083" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T03:58:29.159Z" } } ] } }