Critical Fortinet FortiSandbox Flaw Allows Vulnerability Enables

Enterprise networks face significant risk due to a critical security flaw discovered in Fortinet’s FortiSandbox platform. This vulnerability allows unauthenticated attackers to remotely execute arbitrary code or commands, without needing any credentials.

Fortinet disclosed the vulnerability on May 12, 2026, under the identifier CVE-2026-26083 (FG-IR-26-136), assigning it a CVSSv3 score of 9.1, placing it firmly in the critical severity tier.

The flaw stems from a missing authorization vulnerability (CWE-862) in the FortiSandbox Web UI, affecting the on-premises, cloud, and Platform-as-a-Service (PaaS) variants of the product.

Fortinet FortiSandbox Vulnerability

The vulnerability exists in the GUI component of FortiSandbox’s web interface. Because of the missing authorization check, a remote, unauthenticated attacker can craft malicious HTTP requests to trigger unauthorized code or command execution on the underlying system.

With no authentication barrier and no user interaction required, the attack surface is dangerously broad, and the potential impact spans confidentiality, integrity, and availability.

FortiSandbox is widely deployed in enterprise environments as a core malware analysis and threat detection tool. Compromising it doesn’t just expose a single asset; it potentially blinds an organization’s entire threat detection pipeline.

Affected Versions

The vulnerability impacts a wide range of FortiSandbox deployments:

• FortiSandbox 5.0: Versions 5.0.0–5.0.1 — upgrade to 5.0.2 or above
• FortiSandbox 4.4: Versions 4.4.0–4.4.8 — upgrade to 4.4.9 or above
• FortiSandbox Cloud 24 and 23: All versions — migrate to a fixed release
• FortiSandbox Cloud 5.0: Versions 5.0.2–5.0.5 — upgrade to 5.0.6 or above
• FortiSandbox PaaS 5.0: Versions 5.0.0–5.0.1 — upgrade to 5.0.2 or above
• FortiSandbox PaaS 4.4: Versions 4.4.5–4.4.8 — upgrade to 4.4.9 or above
• Multiple legacy FortiSandbox PaaS versions (23.4, 23.3, 23.1, 22.2, 22.1, 21.4, 21.3): All versions affected — migrate to a fixed release immediately

Fortinet internally discovered and reported the flaw through researcher Adham El Karn of the Fortinet Product Security team.

While the vulnerability has not been observed to be exploited in the wild as of publication, its unauthenticated nature and critical CVSS score make it a prime candidate for rapid weaponization.

Security teams are strongly urged to apply the available patches without delay. Organizations running legacy FortiSandbox PaaS versions with no direct upgrade path must prioritize migration to a supported fixed release.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.