Fortinet Patches Critical RCE Flaws in FortiAuthenticator and FortiSandbox

Fortinet released fixes for two critical vulnerabilities that could let remote, unauthenticated attackers run unauthorized code or commands on exposed systems. The first, CVE-2026-44277, is an improper access control flaw in FortiAuthenticator with a CVSS 9.1 rating; it affects versions 8.0.0, 8.0.2, 6.6.0-6.6.8, and 6.5.0-6.5.6, and was patched in 8.0.3, 6.6.9, and 6.5.7. Fortinet said the issue stems from insufficient authorization checks on API endpoints and could allow unauthorized API access, privilege escalation, and command execution, while FortiAuthenticator Cloud is not affected.

Fortinet also disclosed CVE-2026-26083, a CVSS 9.1 missing-authorization flaw in the FortiSandbox Web UI that impacts FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS, potentially enabling arbitrary code execution across on-premises and cloud deployments. Canada’s Cyber Centre warned that the advisories span multiple Fortinet products and urged administrators to review Fortinet PSIRT notices and apply updates promptly. Public reporting said Fortinet had not observed either flaw being exploited in the wild at disclosure, but the breadth of affected security infrastructure and Fortinet’s history of high-value exploitation have increased urgency around patching exposed appliances.