Loading vulnerability…
Unauthenticated RCE in Fortinet FortiSandbox Web UI
CVE-2026-26083 is a critical missing authorization vulnerability in the GUI component of the Fortinet FortiSandbox Web UI affecting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. Affected versions include FortiSandbox 5.0.0 through 5.0.1 and 4.4.0 through 4.4.8; FortiSandbox Cloud 5.0.2 through 5.0.5 as well as all 23.x and 24.x versions referenced; and FortiSandbox PaaS 5.0.0 through 5.0.1, 4.4.5 through 4.4.8, and all 21.3, 21.4, 22.1, 22.2, 23.1, 23.3, and 23.4 versions. The flaw stems from improper authorization enforcement in the Web UI, including incorrect global authorization checks on certain HTTP request paths, allowing remote unauthenticated attackers to reach restricted functionality and execute unauthorized code or commands via crafted HTTP requests.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote arbitrary code or command execution on the vulnerable FortiSandbox system without authentication. Because FortiSandbox is a malware-analysis and security control platform, compromise can undermine confidentiality, integrity, and availability by allowing attackers to disable or interfere with sandboxing operations, manipulate malware analysis results, access restricted functionality, exfiltrate submitted samples or related analysis data, and potentially pivot into connected Fortinet or enterprise environments.
If you can’t patch tonight, do this now.
No specific workaround is described for this vulnerability in the available information. Until patching or migration is completed, reduce exposure by restricting network access to the FortiSandbox Web UI to trusted administrative networks only, removing internet exposure where possible, and closely monitoring administrative and Web UI activity for anomalous HTTP requests or unexpected command execution. Prioritize internet-facing deployments for immediate remediation.
Patch, then assume compromise.
Upgrade affected deployments to fixed releases. For FortiSandbox, upgrade 5.0.0 through 5.0.1 to 5.0.2 or later, and 4.4.0 through 4.4.8 to 4.4.9 or later. For FortiSandbox Cloud, upgrade 5.0.2 through 5.0.5 to 5.0.6 or later. For FortiSandbox PaaS, upgrade 5.0.0 through 5.0.1 to 5.0.2 or later, and 4.4.5 through 4.4.8 to 4.4.9 or later. Legacy affected Cloud and PaaS branches in the 21.x through 24.x ranges referenced require migration to a supported fixed release because backported patches are not available for those branches.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.