CRITICAL 9.9 NVD

CVE-2026-26084

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5,

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-166

Published: 2026-09-08 · Source: NVD · Feed updated: 2026-09-11

This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-09-08 via NVD.

Risk Timeline

CVE Disclosed2026-09-08 · 2 days ago

Remediation Resources

Analysis & PoC

fortiguard.fortinet.com/psirt/FG-IR-26-166

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.