Fortinet Fixes Critical and High-Severity Flaws Across Network and Sandbox Products
Patch & Detection Intelligence · 7 sources · Updated 2mo ago · First seen Sep 9, 2026
Fortinet released security updates for vulnerabilities affecting FortiOS, FortiProxy, FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. Italy's national CSIRT reported that the set includes one critical and one high-severity issue that could expose sensitive information; affected FortiOS and FortiProxy versions include 7.6.x before 7.6.7, while affected FortiSandbox releases include 5.0.x before 5.0.6 and 4.4.x before 4.4.9.
One disclosed issue, CVE-2026-26084, is a high-severity improper-access-control flaw in the FortiSandbox web interface, rated CVSS 8.9. Unauthenticated remote attackers could use crafted HTTP requests to reach internal API endpoints and retrieve sensitive information without credentials or user interaction. Fortinet reported no evidence of active exploitation and credited internal researcher Adham El Karn; the Canadian Centre for Cyber Security also urged administrators to review Fortinet PSIRT advisories and promptly apply relevant updates across affected Fortinet products.
