CVE-2026-26084

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

  • Published Sep 8, 2026
  • CVSS 9.9 critical
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-26084 at the National Vulnerability Database