Loading story…
Fortinet released multiple security advisories covering FortiSandbox, FortiOS, FortiProxy, FortiPAM, and FortiAuthenticator, with the most serious issue tracked as CVE-2026-59835. The high-severity FortiSandbox flaw, rated CVSS 7.7 and classified as CWE-668, allows unauthenticated attackers to access the VNC server of malware-analysis virtual machines over the network, potentially exposing analysis sessions and interfering with sandbox operations. Fortinet said affected FortiSandbox versions are 5.0.0 through 5.0.2 and 4.4.3 through 4.4.8, while 5.2 and FortiSandbox PaaS are not affected; no in-the-wild exploitation has been reported.
The broader advisory set also addressed additional weaknesses including CVE-2026-59839, which could allow an authenticated CLI user to delete files from the root filesystem, along with lower-severity CRLF injection, path traversal, reflected XSS, buffer over-read, stack-based buffer overflow, and a FortiAuthenticator GUI out-of-bounds read affecting versions 6.6.0 through 6.6.2 and 6.5.0 through 6.5.7. Canada’s Cyber Centre echoed the vendor notice and urged administrators to review the advisories and apply updates, particularly because several affected Fortinet products are commonly deployed in enterprise and internet-facing security environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On July 14, 2026, the Canadian Centre for Cyber Security published advisory AV26-695 highlighting Fortinet advisories for FortiAuthenticator and FortiSandbox vulnerabilities. The notice identified affected version ranges and urged administrators to review Fortinet's advisories and apply the necessary updates.
On July 14, 2026, Fortinet disclosed seven security advisories affecting FortiOS, FortiProxy, FortiPAM, and FortiSandbox. The disclosures included several lower- and medium-severity issues as well as the more serious FortiSandbox unauthenticated VNC exposure and a FortiPAM flaw that could let an authenticated CLI user delete root filesystem files.
On July 14, 2026, Fortinet published advisory FG-IR-26-145 for CVE-2026-59835, a high-severity FortiSandbox flaw that exposes the VNC server of malware-scanning virtual machines to unauthenticated network attackers. Fortinet said affected versions include 5.0.0 through 5.0.2 and 4.4.3 through 4.4.8, credited INPS for reporting the issue, and reported no known in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcethecybersecguru.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcefortiguard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet issued multiple 2026 security advisories covering a broad set of vulnerabilities across **FortiSandbox, FortiManager, FortiAnalyzer, FortiOS, FortiAP, FortiProxy, FortiPAM, FortiSwitchManager, FortiSwitchAXFixed,** and related cloud offerings. The most severe flaws affect **FortiSandbox**, including `CVE-2026-39808`, an unauthenticated OS command injection bug that could allow arbitrary command execution and full device compromise, `CVE-2026-39813`, a path traversal issue in the JRPC API that may enable authentication bypass and privilege escalation, and `CVE-2026-26083`, a missing authorization flaw that can expose restricted functionality and sensitive sandbox analysis data through the GUI without authentication. National cyber authorities in Canada and Belgium separately warned organizations to apply Fortinet’s fixes immediately. Fortinet also disclosed high-risk issues in management platforms, notably `CVE-2025-54820`, a stack-based buffer overflow in the **FortiManager** `fgtupdates` service that can let remote unauthenticated attackers execute unauthorized commands when the service is enabled, as well as a heap-based buffer overflow affecting **FortiAnalyzer Cloud** and **FortiManager Cloud**. Additional weaknesses across the product line include authentication and MFA bypasses, SQL injection, API denial of service, CLI command injection in FortiAP, CAPWAP daemon memory corruption in FortiOS, stored and reflected XSS, improper access control, and credential exposure. Fortinet advised customers to upgrade to fixed releases, disable exposed services such as `fgtupdates` where possible, restrict CLI, SSH, and API access, and monitor logs for anomalous authentication, privilege escalation, and endpoint activity.
Jun 29, 2026
Fortinet released fixes for two **critical** vulnerabilities that could let remote, unauthenticated attackers run unauthorized code or commands on exposed systems. The first, **`CVE-2026-44277`**, is an improper access control flaw in **FortiAuthenticator** with a **CVSS 9.1** rating; it affects versions **8.0.0**, **8.0.2**, **6.6.0-6.6.8**, and **6.5.0-6.5.6**, and was patched in **8.0.3**, **6.6.9**, and **6.5.7**. Fortinet said the issue stems from insufficient authorization checks on API endpoints and could allow unauthorized API access, privilege escalation, and command execution, while **FortiAuthenticator Cloud is not affected**. Fortinet also disclosed **`CVE-2026-26083`**, a **CVSS 9.1** missing-authorization flaw in the **FortiSandbox** Web UI that impacts **FortiSandbox**, **FortiSandbox Cloud**, and **FortiSandbox PaaS**, potentially enabling arbitrary code execution across on-premises and cloud deployments. Canada’s Cyber Centre warned that the advisories span multiple Fortinet products and urged administrators to review Fortinet PSIRT notices and apply updates promptly. Public reporting said Fortinet had not observed either flaw being exploited in the wild at disclosure, but the breadth of affected security infrastructure and Fortinet’s history of high-value exploitation have increased urgency around patching exposed appliances.
Jun 29, 2026
Fortinet has addressed several critical vulnerabilities affecting its FortiSandbox and FortiWeb products, with public advisories and technical details released on December 16, 2025. The most severe issues impact FortiSandbox, where multiple command injection vulnerabilities (CVE-2025-53949) allow authenticated attackers to execute arbitrary code as root via the `admindel_confirm`, `name`, and `upload_vdi_file` parameters. Additionally, a cross-site scripting vulnerability (CVE-2025-54353) in the `hcproxy` component could enable remote code execution with minimal user interaction. Fortinet has released patches for these flaws, and users are strongly advised to update affected systems immediately. For FortiWeb, a critical authentication bypass vulnerability (CVE-2025-64447) was disclosed, stemming from improper verification of cryptographic signatures in the `ApacheCookie_parse` method, allowing unauthenticated attackers to gain access. These disclosures follow recent reports of active exploitation of a separate FortiWeb vulnerability (CVE-2025-64446), which enables unauthenticated attackers to create rogue administrator accounts and fully compromise exposed devices. Organizations using FortiWeb and FortiSandbox should review the official advisories and apply the recommended mitigations to prevent exploitation.
Jun 29, 2026