# CVE-2026-26084

## Summary

- **CVE ID:** CVE-2026-26084
- **Severity:** HIGH
- **CVSS Score:** 8.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C)
- **CWE:** CWE-284
- **Published:** Sep 8, 2026
- **Last Modified:** Sep 8, 2026

## Description

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

## Affected Products

- Fortinet — FortiSandbox PaaS (5.0.4)
- Fortinet — FortiSandbox (5.0.0)
- Fortinet — FortiSandbox (4.4.0)
- Fortinet — FortiSandbox (4.2.1)
- Fortinet — FortiSandbox Cloud (5.0.4)

## References

- [CNA](https://fortiguard.fortinet.com/psirt/FG-IR-26-166)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.24%
- **EPSS Percentile:** 14.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._