Fortinet Patches FortiSandbox VNC Exposure and Other Product Flaws

Fortinet released multiple security advisories covering FortiSandbox, FortiOS, FortiProxy, FortiPAM, and FortiAuthenticator, with the most serious issue tracked as CVE-2026-59835. The high-severity FortiSandbox flaw, rated CVSS 7.7 and classified as CWE-668, allows unauthenticated attackers to access the VNC server of malware-analysis virtual machines over the network, potentially exposing analysis sessions and interfering with sandbox operations. Fortinet said affected FortiSandbox versions are 5.0.0 through 5.0.2 and 4.4.3 through 4.4.8, while 5.2 and FortiSandbox PaaS are not affected; no in-the-wild exploitation has been reported.

The broader advisory set also addressed additional weaknesses including CVE-2026-59839, which could allow an authenticated CLI user to delete files from the root filesystem, along with lower-severity CRLF injection, path traversal, reflected XSS, buffer over-read, stack-based buffer overflow, and a FortiAuthenticator GUI out-of-bounds read affecting versions 6.6.0 through 6.6.2 and 6.5.0 through 6.5.7. Canada’s Cyber Centre echoed the vendor notice and urged administrators to review the advisories and apply updates, particularly because several affected Fortinet products are commonly deployed in enterprise and internet-facing security environments.