Fortinet FortiSandbox Critical RCE: Unauthenticated Attackers Can Execute Commands

A critical missing authorization vulnerability, tracked as CVE-2026-26083, has been identified in multiple Fortinet FortiSandbox and FortiSandbox PaaS versions. According to the National Vulnerability Database, this flaw allows an unauthenticated attacker to execute arbitrary code or commands through crafted HTTP requests. The severity is rated 9.8 CVSS, indicating extreme risk.

This isn’t a theoretical risk; it’s a direct path for unauthenticated attackers to gain control. The vulnerability spans FortiSandbox 5.0.0 through 5.0.1, 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, and numerous FortiSandbox PaaS iterations from versions 21.3 up to 23.4. The scope of affected products is broad, impacting both on-premise and cloud deployments.

The attacker’s calculus here is simple: find an exposed FortiSandbox instance, send a malicious HTTP request, and gain remote code execution. This bypasses authentication entirely, making it a prime target for initial access. Defenders must prioritize patching and ensure these critical security tools aren’t becoming an entry point themselves.