【Vulnerability Alert】Fortinet's FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS Contain a Critical Security Vulnerability (CVE-2026-26084)

• Subject:【Vulnerability Alert】Fortinet's FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS Contain a Critical Security Vulnerability (CVE-2026-26084)

• Description:
  • Forwarded from TWCERT/CC Security Advisory TWCERTCC-200-202609-00000012
  • The web interface of Fortinet's FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS has a missing access control vulnerability (CVE-2026-26084, CVSS: 9.9), allowing unauthenticated attackers to access sensitive information via crafted HTTP requests.
• Affected Platforms:
  • FortiSandbox versions 5.0.0 through 5.0.5
  • FortiSandbox versions 4.4.0 through 4.4.8
  • FortiSandbox Cloud versions 5.0.4 through 5.0.5
  • FortiSandbox PaaS versions 5.0.4 through 5.0.5
• Recommended Actions:
  • Please update to the following versions: FortiSandbox 5.0.6 and later, FortiSandbox 4.4.9 and later, FortiSandbox Cloud 5.0.6 and later, FortiSandbox PaaS 5.0.6 and later
• References:
  1. https://www.twcert.org.tw/tw/cp-169-11194-d4015-1.html

Computer and Communication Center
Network System Division