Critical Fortinet FortiSandbox RCE flaw CVE-2023-34981 patched

Key Takeaways

• A critical remote code execution (RCE) vulnerability (CVE-2026-26083) has been identified in Fortinet FortiSandbox.
• The flaw allows unauthenticated attackers to execute arbitrary code or commands through the web UI without requiring credentials.
• The vulnerability impacts various FortiSandbox deployments, including on-premises, cloud, and PaaS versions.
• Fortinet has released patches and urges users to upgrade immediately to mitigate the risk.

A severe security vulnerability in Fortinet’s FortiSandbox platform poses a substantial risk to enterprise networks, allowing unauthorized attackers to remotely execute arbitrary code. The flaw, which does not require any form of authentication, has been assigned a critical severity rating.

Fortinet officially disclosed this vulnerability on May 12, 2026, under the identifier CVE-2026-26083 (FG-IR-26-136). It carries a CVSSv3 score of 9.1, placing it firmly in the critical tier. The core issue lies in a missing authorization check within the FortiSandbox Web UI, categorized as CWE-862 (Missing Authorization).

Fortinet FortiSandbox Vulnerability Details

The vulnerability specifically resides in the graphical user interface (GUI) component of FortiSandbox’s web interface. Due to the absence of proper authorization verification, a remote attacker can craft and send malicious HTTP requests. These requests can then trigger the execution of unauthorized code or commands on the underlying system hosting FortiSandbox.

The absence of an authentication barrier and the lack of any required user interaction significantly broaden the attack surface. This makes the vulnerability particularly dangerous, as a successful exploit could compromise the confidentiality, integrity, and availability of affected systems.

FortiSandbox is a crucial tool widely deployed in enterprise environments for malware analysis and advanced threat detection. A compromise of this platform could extend beyond a single asset, potentially incapacitating an organization’s entire threat detection and response capabilities.

Affected Versions

The vulnerability affects a broad spectrum of FortiSandbox deployments. Users are advised to review their versions and upgrade as recommended:

• FortiSandbox 5.0: Versions 5.0.0 through 5.0.1. Users should upgrade to 5.0.2 or later.
• FortiSandbox 4.4: Versions 4.4.0 through 4.4.8. Users should upgrade to 4.4.9 or later.
• FortiSandbox Cloud 24 and 23: All versions are affected. Users must migrate to a fixed release.
• FortiSandbox Cloud 5.0: Versions 5.0.2 through 5.0.5. Users should upgrade to 5.0.6 or later.
• FortiSandbox PaaS 5.0: Versions 5.0.0 through 5.0.1. Users should upgrade to 5.0.2 or later.
• FortiSandbox PaaS 4.4: Versions 4.4.5 through 4.4.8. Users should upgrade to 4.4.9 or later.
• Multiple legacy FortiSandbox PaaS versions (23.4, 23.3, 23.1, 22.2, 22.1, 21.4, 21.3): All versions are affected. Immediate migration to a fixed release is required.

The flaw was internally discovered and reported by Adham El Karn from Fortinet’s Product Security team.

While there are no reports of this vulnerability being actively exploited in the wild at the time of publication, its critical CVSS score and unauthenticated nature make it a prime candidate for rapid weaponization by threat actors. Security teams must prioritize applying the available patches without delay. Organizations utilizing legacy FortiSandbox PaaS versions that lack a direct upgrade path should immediately plan for migration to a supported, fixed release.

What You Should Do

• Immediately Apply Patches: Upgrade all affected FortiSandbox deployments to the recommended patched versions as soon as possible.
• Review Fortinet’s Advisory: Consult the official FortiGuard Security Advisory (FG-IR-26-136) for detailed instructions and version-specific upgrade paths.
• Migrate Legacy Systems: If running legacy FortiSandbox PaaS versions that do not have a direct upgrade path, plan and execute migration to a supported, fixed release immediately.
• Monitor for Exploitation: While not currently exploited in the wild, remain vigilant and monitor network traffic for any signs of attempted exploitation targeting FortiSandbox instances.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.