FortiSandbox CVE-2026-26083: Overview of a Critical Unauthenticated RCE via Missing Authorization

Introduction

A missing-authorization flaw in the Web UI of Fortinet FortiSandbox lets unauthenticated attackers execute arbitrary code or commands remotely. NVD rates it CVSS 9.8, critical. For organizations that rely on FortiSandbox as their core malware analysis and threat detection layer, a compromised appliance could blind the security team to other threats moving across the network.

FortiSandbox is Fortinet's dedicated sandboxing product. It detonates and analyzes suspicious files and URLs in an isolated environment. It integrates tightly with the Fortinet Security Fabric, including FortiGate firewalls and FortiMail, and runs as on-premises appliances, cloud instances, and platform-as-a-service offerings. Because it is itself a security control, it is a particularly high-value target.

Technical Information

CVE-2026-26083 is classified under CWE-862 (Missing Authorization) and affects the GUI component of the FortiSandbox Web UI. Fortinet describes the root cause as an "incorrect global authorization check." Certain HTTP request paths in the Web UI had no proper authorization logic in front of them, so the system did not verify whether the caller had any identity or privilege level before it processed the request.

Attack Flow

The exploitation path is straightforward:

1. An attacker finds a network-accessible FortiSandbox instance that exposes its Web UI (typically over HTTPS).
2. The attacker crafts HTTP requests to the vulnerable endpoints that lack authorization enforcement.
3. The backend processes those requests without any identity check, because it requires no authentication token, session cookie, or credential validation.
4. The attacker executes code or commands on the underlying FortiSandbox system without authorization.

The attack needs no prior authentication and no user interaction. The CVSS 9.8 score from NVD reflects the network attack vector, low attack complexity, and full impact on confidentiality, integrity, and availability. Fortinet's own PSIRT scored it 9.1, which is still firmly in the critical range.

FortiSandbox processes potentially malicious files by design. An attacker with code execution on the platform could manipulate analysis results, exfiltrate submitted samples (which may contain sensitive organizational data), pivot to other integrated Fortinet components, or simply disable the sandbox so malware passes through undetected.

The vulnerability spans all deployment models:

• On-premises FortiSandbox appliances (versions 5.0.0 through 5.0.1 and 4.4.0 through 4.4.8)
• FortiSandbox Cloud (versions 5.0.2 through 5.0.5, plus all Cloud 23 and Cloud 24 versions)
• FortiSandbox PaaS (versions 5.0.0 through 5.0.1, 4.4.5 through 4.4.8, and all legacy branches from 21.3 through 23.4)

Patch Information

Fortinet has released firmware updates that fix CVE-2026-26083 under advisory FG-IR-26-136. FortiSandbox is a proprietary, closed-source product, so no source-level code diff is public. The fix ships only through Fortinet's firmware upgrade path.

The updated firmware enforces authorization in the FortiSandbox Web UI layer. It adds the missing authorization gates to the HTTP request paths that previously allowed unauthenticated access.

The full matrix of affected versions and their fixed releases:

Notes on the fix strategy:

• For current branches (5.0 and 4.4): Fortinet provides point-release upgrades. FortiSandbox 5.0 users move to 5.0.2 or later, and 4.4 users move to 4.4.9 or later. The same applies to PaaS and Cloud variants on these branches.
• For legacy PaaS and Cloud branches (21.x through 23.x, Cloud 23/24): These older release trains will not get a backported patch. Fortinet tells users to migrate entirely to a supported release branch that contains the fix. These branches have likely reached or are approaching end of support.
• For Cloud and PaaS customers: Confirm your migration status with Fortinet directly. Do not assume remediation has happened automatically.

Affected Systems and Versions

The following FortiSandbox products and version ranges are confirmed vulnerable:

On-Premises:

• FortiSandbox 5.0.0 through 5.0.1
• FortiSandbox 4.4.0 through 4.4.8

Cloud:

• FortiSandbox Cloud 5.0.2 through 5.0.5
• FortiSandbox Cloud 24: all versions
• FortiSandbox Cloud 23: all versions

Platform as a Service (PaaS):

• FortiSandbox PaaS 5.0.0 through 5.0.1
• FortiSandbox PaaS 4.4.5 through 4.4.8
• FortiSandbox PaaS 23.4: all versions
• FortiSandbox PaaS 23.3: all versions
• FortiSandbox PaaS 23.1: all versions
• FortiSandbox PaaS 22.2: all versions
• FortiSandbox PaaS 22.1: all versions
• FortiSandbox PaaS 21.4: all versions
• FortiSandbox PaaS 21.3: all versions

Any FortiSandbox deployment with its Web UI reachable over the network is potentially exploitable.

Vendor Security History

Threat actors have repeatedly targeted Fortinet products, and the record is well documented. CISA has added 24 Fortinet vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, and 13 of those are confirmed as used in ransomware campaigns.

Recent critical Fortinet vulnerabilities, for context:

FortiSandbox alone now has three critical unauthenticated RCE vulnerabilities (CVE-2026-39808, CVE-2026-39813, and CVE-2026-26083). That pattern suggests systemic authorization weaknesses in the platform's Web UI and API layers. Security teams running FortiSandbox should treat it as a recurring risk area that needs closer monitoring and faster patch cycles.

References

• NVD Entry for CVE-2026-26083
• Fortinet PSIRT Advisory FG-IR-26-136
• Critical Fortinet FortiSandbox Vulnerability Enables Code Execution (CybersecurityNews)
• Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator (BleepingComputer)
• PoC Released for FortiSandbox Flaw Enabling Arbitrary Command Execution (GBHackers)
• Fortinet RCE Vulnerabilities: Critical Flaws in FortiSandbox (Greenbone)
• Fortinet FortiSandbox Vulnerabilities: Find Impacted Assets (runZero)
• Fortinet PSIRT Advisories