Loading story…
Fortinet released security updates for vulnerabilities affecting FortiOS, FortiProxy, FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. Italy's national CSIRT reported that the set includes one critical and one high-severity issue that could expose sensitive information; affected FortiOS and FortiProxy versions include 7.6.x before 7.6.7, while affected FortiSandbox releases include 5.0.x before 5.0.6 and 4.4.x before 4.4.9.
One disclosed issue, CVE-2026-26084, is a high-severity improper-access-control flaw in the FortiSandbox web interface, rated CVSS 8.9. Unauthenticated remote attackers could use crafted HTTP requests to reach internal API endpoints and retrieve sensitive information without credentials or user interaction. Fortinet reported no evidence of active exploitation and credited internal researcher Adham El Karn; the Canadian Centre for Cyber Security also urged administrators to review Fortinet PSIRT advisories and promptly apply relevant updates across affected Fortinet products.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-898 covering vulnerabilities in multiple Fortinet products and directed administrators to review Fortinet PSIRT advisories and apply required security updates.
Multiple Fortinet products were identified as affected by vulnerabilities, including FortiOS and FortiProxy 7.6.1–7.6.6, FortiPAM Chrome Extension 7.4 and 8.0, FortiSandbox product releases, and FortiMonitorOnSight 7.2 releases.
Fortinet released security updates for vulnerabilities, including one critical and one high-severity issue, affecting FortiOS, FortiProxy, FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. The updates address flaws that could allow access to sensitive information, with FortiOS and FortiProxy fixed in 7.6.7 and affected FortiSandbox 5.0 and 4.4 releases fixed in 5.0.6 and 4.4.9, respectively.
Fortinet disclosed CVE-2026-26084, a CVSS 8.9 improper-access-control vulnerability in the FortiSandbox web interface that could let unauthenticated attackers use crafted HTTP requests to obtain sensitive information from internal API endpoints. Fortinet credited Product Security researcher Adham El Karn, said it had no evidence of exploitation in the wild, and provided fixed releases including FortiSandbox 5.0.6 and 4.4.9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcecirt.gy
Open sourcefortiguard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet released multiple security advisories covering **FortiSandbox**, **FortiOS**, **FortiProxy**, **FortiPAM**, and **FortiAuthenticator**, with the most serious issue tracked as **`CVE-2026-59835`**. The high-severity FortiSandbox flaw, rated **CVSS 7.7** and classified as **`CWE-668`**, allows unauthenticated attackers to access the VNC server of malware-analysis virtual machines over the network, potentially exposing analysis sessions and interfering with sandbox operations. Fortinet said affected FortiSandbox versions are **5.0.0 through 5.0.2** and **4.4.3 through 4.4.8**, while **5.2** and **FortiSandbox PaaS** are not affected; no in-the-wild exploitation has been reported. The broader advisory set also addressed additional weaknesses including **`CVE-2026-59839`**, which could allow an authenticated CLI user to delete files from the root filesystem, along with lower-severity CRLF injection, path traversal, reflected XSS, buffer over-read, stack-based buffer overflow, and a FortiAuthenticator GUI out-of-bounds read affecting versions **6.6.0 through 6.6.2** and **6.5.0 through 6.5.7**. Canada’s Cyber Centre echoed the vendor notice and urged administrators to review the advisories and apply updates, particularly because several affected Fortinet products are commonly deployed in enterprise and internet-facing security environments.
Jul 15, 2026
Italian and Colombian cyber authorities issued alerts on vulnerabilities affecting **Fortinet** products, with CSIRT Italia detailing multiple information-disclosure flaws in **FortiSandbox** and **FortiAuthenticator** and warning that two of the issues are rated **high severity**. The disclosed weaknesses could allow a malicious user to access sensitive information on affected systems, expanding risk for organizations that rely on these appliances for authentication and sandboxing functions. CSIRT Italia said the affected products span specific version ranges and urged administrators to apply the updates referenced in Fortinet security bulletins. Separate **COLCERT** alerts also warned of **critical vulnerabilities** in Fortinet products, reinforcing the need for immediate review of exposed deployments even though the Colombian notices provided limited technical detail on affected versions, CVE identifiers, or exploitation activity.
Aug 1, 2026
Fortinet released fixes for two **critical** vulnerabilities that could let remote, unauthenticated attackers run unauthorized code or commands on exposed systems. The first, **`CVE-2026-44277`**, is an improper access control flaw in **FortiAuthenticator** with a **CVSS 9.1** rating; it affects versions **8.0.0**, **8.0.2**, **6.6.0-6.6.8**, and **6.5.0-6.5.6**, and was patched in **8.0.3**, **6.6.9**, and **6.5.7**. Fortinet said the issue stems from insufficient authorization checks on API endpoints and could allow unauthorized API access, privilege escalation, and command execution, while **FortiAuthenticator Cloud is not affected**. Fortinet also disclosed **`CVE-2026-26083`**, a **CVSS 9.1** missing-authorization flaw in the **FortiSandbox** Web UI that impacts **FortiSandbox**, **FortiSandbox Cloud**, and **FortiSandbox PaaS**, potentially enabling arbitrary code execution across on-premises and cloud deployments. Canada’s Cyber Centre warned that the advisories span multiple Fortinet products and urged administrators to review Fortinet PSIRT notices and apply updates promptly. Public reporting said Fortinet had not observed either flaw being exploited in the wild at disclosure, but the breadth of affected security infrastructure and Fortinet’s history of high-value exploitation have increased urgency around patching exposed appliances.
Jun 29, 2026