CVE-2026-26084

CRITICAL9.9

Published 2026-09-08 · Updated 2026-09-08 · Source psirt@fortinet.com

Description

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

CWE-284

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-166

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-83941
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
2026-09-08 · score 9.9
CVE-2026-81376
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
2026-09-08 · score 9.6
CVE-2026-78510
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
2026-09-08 · score 9.8
CVE-2026-78509
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
2026-09-08 · score 9.8
CVE-2026-78445
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
2026-09-08 · score 9.8