🚨 FortiSandbox CVE-2026-26084 (CVSS 8.9): Unauthenticated Info Disclosure — Patch Now
Fortinet disclosed CVE-2026-26084 on Sep 9, 2026 — a CWE-284 Improper Access Control bug in FortiSandbox's web UI. An unauthenticated attacker can send a crafted HTTP request directly to internal API endpoints and pull sensitive data — no auth, no user interaction, no malware needed.
Why devs/security engineers should care:
FortiSandbox stores config data, sample metadata, and detection logs. Leaked data = recon gold for attackers mapping your detection logic before a bigger breach.
Affected:
- FortiSandbox 5.0.0–5.0.5 → patch to 5.0.6+
- FortiSandbox 4.4.0–4.4.8 → patch to 4.4.9+
- FortiSandbox Cloud/PaaS 5.0.4–5.0.5 → patch to 5.0.6+ Safe: FortiSandbox 5.2, Cloud 4.4, PaaS 5.2
No workaround exists — upgrade is mandatory. Discovered internally by Fortinet's own PSIRT team (Adham El Karn). No confirmed in-the-wild exploitation yet, but prior FortiSandbox access-control CVEs this year landed on CISA's KEV list after active exploitation.
Hardening checklist:
✅ Patch immediately
✅ Never expose the mgmt web UI to the internet
✅ Put it behind VPN/jump host
✅ Segment the network
✅ Centralize logs to SIEM for anomaly detection
Full write-up with attack-chain breakdown + detection queries:
https://www.xpert4cyber.com/2026/09/fortisandbox-cve-2026-26084-patch.html
Top comments (0)