Loading vulnerability…
Unauthenticated VNC Access in Fortinet FortiSandbox
CVE-2026-59835 is an exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2 and 4.4.3 through 4.4.8. VNC servers associated with virtual machines performing malware scans are exposed on all network interfaces, allowing unauthenticated attackers to access them through network requests. Affected hardware models include FSA-500G and FSA-1500G. The vulnerability exposes scanning VM desktop sessions and potentially sensitive analysis information. FortiSandbox 5.2 and FortiSandbox PaaS are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information through unauthorized access to scanning VM graphical desktop sessions. Exposed information may include submitted files, malware samples, screenshots, and analysis activity. Unauthorized interaction with these sessions could also undermine the integrity of malware analysis. The vulnerability does not directly provide remote code execution or establish compromise of the underlying appliance.
If you can’t patch tonight, do this now.
Restrict network access to scanning VM VNC services using firewall policies and network segmentation, preventing access from untrusted networks. Ensure management interfaces are not publicly accessible and limit administrative access to trusted networks. Disable unnecessary VNC exposure where supported, and monitor network logs for unexpected connections to internal VNC services. These measures reduce exposure but do not replace upgrading.
Patch, then assume compromise.
Upgrade affected FortiSandbox 5.0 installations to version 5.0.3 or later, or affected 4.4 installations to version 4.4.9 or later. FortiSandbox 5.2 and FortiSandbox PaaS are unaffected and require no remediation for this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.