CVE-2026-26084: FortiSandbox Access Control Vulnerability

CVE-2026-26084 Overview

CVE-2026-26084 is an improper access control vulnerability [CWE-284] affecting multiple versions of Fortinet FortiSandbox. The flaw allows a remote, unauthenticated attacker to access sensitive information by sending crafted HTTP requests to the affected appliance. Fortinet published advisory FG-IR-26-166 covering the issue.

The vulnerability impacts FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5. The attack vector is network-based, requires no privileges, and requires no user interaction.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive information and impact availability across FortiSandbox appliances, cloud, and PaaS deployments.

Affected Products

Fortinet FortiSandbox 5.0.0 through 5.0.5
Fortinet FortiSandbox 4.4.0 through 4.4.8
Fortinet FortiSandbox Cloud 5.0.4 through 5.0.5 and FortiSandbox PaaS 5.0.4 through 5.0.5

Discovery Timeline

2026-09-08 - CVE-2026-26084 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-26084

Vulnerability Analysis

The vulnerability originates in the HTTP request handling logic of the FortiSandbox management interface. Authorization checks are not consistently enforced on specific endpoints. An unauthenticated remote attacker can send crafted HTTP requests to reach protected resources and retrieve sensitive information.

The scope of the flaw extends beyond the vulnerable component. Successful exploitation impacts resources controlled by a different security authority, which explains the changed scope classification. Attackers can leverage this access to obtain configuration data, analysis results, or other sensitive artifacts stored on the sandbox appliance.

Availability impact is also present. Repeated abuse of the exposed endpoints, or manipulation of resources reachable through them, can degrade sandbox operations and disrupt malware analysis pipelines that downstream security controls depend on.

Root Cause

The root cause is improper access control [CWE-284] on HTTP endpoints exposed by the FortiSandbox web interface. The application fails to validate the requester's authorization before returning data or acting on the request. This aligns with the CWE-284 category of missing or inadequate access enforcement checks.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker sends crafted HTTP requests to the management interface of a vulnerable FortiSandbox instance. No user interaction is required, and no credentials are needed to trigger the flaw. Verified proof-of-concept code has not been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Fortinet Security Advisory FG-IR-26-166 for vendor-provided technical details.

Detection Methods for CVE-2026-26084

Indicators of Compromise

Unexpected HTTP requests to FortiSandbox management endpoints from external or non-administrative source addresses.
Access log entries showing successful responses to unauthenticated requests targeting internal API paths.
Unusual outbound transfers of sandbox analysis data or configuration exports.

Detection Strategies

Inspect FortiSandbox HTTP access logs for anomalous request patterns and endpoints returning non-empty responses without prior authentication.
Correlate management-interface traffic with an allowlist of administrator source IPs and flag deviations.
Deploy network detections for repeated probing of FortiSandbox web paths from a single source over a short interval.

Monitoring Recommendations

Forward FortiSandbox web and audit logs to a central SIEM or data lake for retention and cross-source correlation.
Alert on administrative actions, credential retrieval, or configuration downloads that occur outside of change windows.
Monitor for connections to the FortiSandbox management interface originating from untrusted network segments.

How to Mitigate CVE-2026-26084

Immediate Actions Required

Restrict network access to the FortiSandbox management interface to trusted administrative networks only.
Inventory all FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS instances and confirm current firmware versions.
Apply the fixed release identified in Fortinet advisory FG-IR-26-166 as soon as it is available in your environment.
Review recent access logs for signs of unauthenticated requests to management endpoints.

Patch Information

Fortinet has published advisory FG-IR-26-166 describing the fixed versions for FortiSandbox 4.4.x, FortiSandbox 5.0.x, FortiSandbox Cloud, and FortiSandbox PaaS. Refer to the Fortinet Security Advisory FG-IR-26-166 for the exact fixed releases and upgrade guidance. Cloud and PaaS deployments should be validated against the versions Fortinet has moved to the fixed baseline.

Workarounds

Place the FortiSandbox management interface behind a management VPN or jump host with strict access controls.
Enforce firewall rules limiting inbound HTTP and HTTPS access to the appliance to specific administrator IP addresses.
Disable or block exposure of the management interface to any untrusted network until patches are applied.

bash

# Configuration example: restrict management access with a trusted host entry
config system admin
    edit admin
        set trusthost1 10.0.0.0 255.255.255.0
    next
end