Loading vulnerability…
Unauthenticated Access Control Bypass in Fortinet FortiSandbox Web Interface
CVE-2026-26084 is an improper access control vulnerability in the shared web interface of Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. Unauthenticated remote attackers can send crafted HTTP requests to internal API endpoints to access sensitive information without an authorized session. Affected versions are FortiSandbox 5.0.0–5.0.5 and 4.4.0–4.4.8, and FortiSandbox Cloud and FortiSandbox PaaS 5.0.4–5.0.5. Exploitation requires neither prior privileges nor user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes sensitive information without authentication. Potentially exposed information includes appliance configuration details, logs, sample metadata, and other operational data, which could assist reconnaissance, detection evasion, or subsequent intrusion attempts. The vendor advisory additionally identifies unauthenticated control of NAT rules, although the precise operational consequences are not specified. Remote code execution is not established.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict access to the affected web and management interfaces to trusted management networks and authorized administrators using network segmentation and access controls. Remove unnecessary external exposure and monitor for anomalous HTTP requests to internal API endpoints. These measures reduce exposure but do not correct the underlying access control flaw.
Patch, then assume compromise.
Upgrade FortiSandbox 5.0.0–5.0.5 to 5.0.6 or later, and FortiSandbox 4.4.0–4.4.8 to 4.4.9 or later. Upgrade FortiSandbox Cloud and FortiSandbox PaaS 5.0.4–5.0.5 to 5.0.6 or later. FortiSandbox 5.2, FortiSandbox Cloud 4.4, and FortiSandbox PaaS 5.2 are identified as unaffected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.