CVE-2026-26084

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

Scoring

Severity

HIGH

CVSS base score

8.9

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C

EPSS probability

0.24%

CWE

CWE-284

Published

2026-09-08

Last modified

2026-09-08

Affected products

• Fortinet FortiSandbox PaaS
• Fortinet FortiSandbox
• Fortinet FortiSandbox
• Fortinet FortiSandbox
• Fortinet FortiSandbox Cloud

Weakness type

• CWE-284

Related vulnerabilities

• CVE-2026-50165 — alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
• CVE-2026-86774 — Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
• CVE-2026-19625 — IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
• CVE-2026-75998 — ColdFusion | Improper Access Control (CWE-284)
• CVE-2026-86672 — ningzichun Student Management System Backup example.7z information disclosure
• CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
• CVE-2026-77487 — SQL Server Elevation of Privilege Vulnerability
• CVE-2026-73028 — SQL Server Elevation of Privilege Vulnerability

Markdown version · Browse all CVEs