---
id: CVE-2026-26083
title: >-
  A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through
  5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through
  5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all
  versions, Forti…
summary: >-
  A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through
  5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through
  5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all
  versions, Forti…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: fortinet
product: fortisandbox
affected:
  - 'fortisandbox >= 4.4.0, < 4.4.9'
  - 'fortisandbox >= 5.0.0, < 5.0.2'
  - 'fortisandbox_cloud >= 5.0.2, < 5.0.6'
  - 'fortisandbox_cloud >= 23.1.4245, <= 23.4.4374'
  - fortisandbox_cloud = 24.1.4436
  - 'fortisandbox_paas >= 4.4.5, < 4.4.9'
  - 'fortisandbox_paas >= 5.0.0, < 5.0.2'
  - 'fortisandbox_paas >= 21.3.4055, <= 23.4.4374'
patched:
  - fortisandbox 5.0.2
  - fortisandbox_cloud 5.0.6
  - fortisandbox_paas 5.0.2
published: '2026-05-12'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-26083'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-136'
    label: psirt@fortinet.com
tags:
  - nvd
epss: 0.00733
epssPercentile: 0.52957
ingestedAt: '2026-07-08T14:51:15.659Z'
---

## Overview

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

## Affected

- `fortisandbox >= 4.4.0, < 4.4.9`
- `fortisandbox >= 5.0.0, < 5.0.2`
- `fortisandbox_cloud >= 5.0.2, < 5.0.6`
- `fortisandbox_cloud >= 23.1.4245, <= 23.4.4374`
- `fortisandbox_cloud = 24.1.4436`
- `fortisandbox_paas >= 4.4.5, < 4.4.9`
- `fortisandbox_paas >= 5.0.0, < 5.0.2`
- `fortisandbox_paas >= 21.3.4055, <= 23.4.4374`

## Remediation

Upgrade past the affected range:

- `fortisandbox 5.0.2`
- `fortisandbox_cloud 5.0.6`
- `fortisandbox_paas 5.0.2`