A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5

CVE-2026-26084 is an improper access control flaw (CWE-284) in Fortinet FortiSandbox versions 4.4.0–4.4.8, 5.0.0–5.0.5, FortiSandbox Cloud 5.0.4–5.0.5, and FortiSandbox PaaS 5.0.4–5.0.5. An unauthenticated attacker who can reach the management interface over HTTP can craft requests to manipulate network rules and exfiltrate sensitive data — including sandboxed malware samples, analysis metadata, and potentially configuration secrets that tie FortiSandbox to upstream FortiGate/FortiMail infrastructure. The fix is FortiSandbox 4.4.9 or 5.0.6.

Fortinet rates this CRITICAL at 9.9, driven by the CVSS:3.1 vector's unauthenticated, network-accessible, no-interaction, scope-changed profile with high availability impact. That score is defensible *in theory* — but it ignores a decisive real-world constraint: FortiSandbox management interfaces are almost never internet-facing. This is an internal-only appliance by design, deployed behind FortiGate and accessible only to SOC operators on management VLANs. The 9.9 treats it as if it were a public-facing load balancer. In practice, an attacker needs prior internal network access before this vuln is reachable, which compresses the exploitable population significantly. noisgate downgrades to HIGH 7.8.

Why this verdict

• Internal-only attack surface: FortiSandbox management interfaces are deployed on isolated management VLANs by design. Shodan/Censys exposure is negligible (<500 instances globally). The CVSS AV:N is technically accurate but practically misleading — reaching this endpoint requires a prior compromise stage, which is a compounding downward pressure of ~1.5 points.
• No exploitation activity or PoC: Unlike sibling CVEs 2026-39808 and 2026-39813 which are KEV-listed with public PoCs, this CVE has zero confirmed exploitation and no public weaponization. This reduces urgency by ~0.5 points relative to baseline.
• Impact is data exposure + rule manipulation, not RCE: The flaw does not grant code execution. The attacker can read sensitive data and manipulate sandbox rules, which is serious for security posture but does not directly yield shell access or domain compromise. This caps the impact ceiling below what the S:C scope-change implies.
• Role multiplier: FortiSandbox occupies the *detection plane* role (analogous to SIEM/security tooling in the high-value catalog). Compromise succeeds in this role and the blast radius is *security blindness* — the attacker can whitelist their malware through the sandbox, undermining the entire Fortinet threat-analysis chain (FortiGate → FortiSandbox verdict loop). This is fleet-impact at the detection layer. This role establishes a HIGH floor that prevents downgrade to MEDIUM despite the internal-access friction.

Why not higher?

CRITICAL would require either active exploitation (KEV listing), a public PoC enabling mass weaponization, or direct code execution on a canonically high-value component. This CVE has none of those. The impact is limited to data exposure and rule manipulation — serious for security posture but not equivalent to RCE-as-root (which sibling CVE-2026-39808 *does* provide). The internal-only deployment posture further compresses real-world risk below the CRITICAL threshold.

Why not lower?

FortiSandbox is a security/detection-plane appliance. Compromising it doesn't just affect one host — it blinds the sandbox analysis pipeline that FortiGate, FortiMail, and FortiClient EMS rely on for verdict decisions. An attacker who can manipulate sandbox rules can whitelist their tooling across the entire Fortinet stack. This detection-plane blast radius, combined with the unauthenticated/no-interaction attack profile, establishes a firm HIGH floor that friction alone cannot breach.

1. Restrict FortiSandbox management to dedicated management VLAN with explicit ACLs — Ensure only SOC operator workstations and FortiManager can reach FortiSandbox on ports 443/514/541. This is the single most effective control — if the interface is unreachable, the vuln is unexploitable. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Enable FortiManager centralized management with config-change alerting — FortiManager can detect and revert unauthorized configuration changes on FortiSandbox, neutralizing the rule-manipulation attack path. Enable config-drift alerts to SIEM.
3. Monitor FortiSandbox access logs for unauthenticated API/HTTP requests — Forward FortiSandbox syslog to SIEM and alert on HTTP requests to management endpoints from non-whitelisted IPs. This provides detection coverage until patching is complete.
4. Audit FortiSandbox-to-FortiGate API credentials — Rotate any shared API keys or service account credentials between FortiSandbox and other Fortinet components. If the attacker already exfiltrated these, rotation limits the blast radius of credential reuse.

Run this script on the FortiSandbox appliance itself via SSH as admin, or from any host with curl and network access to the FortiSandbox management IP. Usage: bash check_cve_2026_26084.sh <FORTISANDBOX_IP>. No special privileges needed beyond network connectivity.

#!/bin/bash
# check_cve_2026_26084.sh — Detect CVE-2026-26084 exposure on FortiSandbox
# Usage: bash check_cve_2026_26084.sh <FORTISANDBOX_MGMT_IP>
# Returns: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <FortiSandbox-management-IP-or-hostname>"
  exit 2
fi

echo "[*] Checking FortiSandbox version at https://$TARGET ..."

# Attempt to pull version info from the login page or API
VERSION_RAW=$(curl -sk --max-time 10 "https://$TARGET/api/v2/monitor/system/firmware" 2>/dev/null || \
              curl -sk --max-time 10 "https://$TARGET/" 2>/dev/null | grep -oP 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [ -z "$VERSION_RAW" ]; then
  echo "[!] Could not retrieve version from $TARGET"
  echo "UNKNOWN"
  exit 1
fi

echo "[*] Detected version string: $VERSION_RAW"

# Extract major.minor.patch
VERSION=$(echo "$VERSION_RAW" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

if [ -z "$MAJOR" ] || [ -z "$MINOR" ] || [ -z "$PATCH" ]; then
  echo "[!] Could not parse version components from: $VERSION"
  echo "UNKNOWN"
  exit 1
fi

echo "[*] Parsed version: $MAJOR.$MINOR.$PATCH"

# Check vulnerable ranges:
# 4.4.0 - 4.4.8 => vulnerable; 4.4.9+ => patched
# 5.0.0 - 5.0.5 => vulnerable; 5.0.6+ => patched
if [ "$MAJOR" -eq 4 ] && [ "$MINOR" -eq 4 ]; then
  if [ "$PATCH" -le 8 ]; then
    echo "[!] FortiSandbox $VERSION is in vulnerable range 4.4.0-4.4.8"
    echo "VULNERABLE"
    exit 0
  else
    echo "[+] FortiSandbox $VERSION is patched (>= 4.4.9)"
    echo "PATCHED"
    exit 0
  fi
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 0 ]; then
  if [ "$PATCH" -le 5 ]; then
    echo "[!] FortiSandbox $VERSION is in vulnerable range 5.0.0-5.0.5"
    echo "VULNERABLE"
    exit 0
  else
    echo "[+] FortiSandbox $VERSION is patched (>= 5.0.6)"
    echo "PATCHED"
    exit 0
  fi
elif [ "$MAJOR" -ge 6 ] || ([ "$MAJOR" -eq 5 ] && [ "$MINOR" -ge 1 ]); then
  echo "[+] FortiSandbox $VERSION is beyond affected branches"
  echo "PATCHED"
  exit 0
else
  echo "[?] FortiSandbox $VERSION is outside known affected ranges"
  echo "UNKNOWN"
  exit 1
fi

Sources

1. Fortinet PSIRT Advisory FG-IR-26-136
2. SecurityOnline – Critical Fortinet Vulnerabilities
3. OffSeq Threat Radar – CVE-2026-26084
4. Greenbone – Fortinet RCE Vulnerabilities in FortiSandbox
5. BleepingComputer – Fortinet Critical RCE Flaws
6. CSA Singapore – Alert AL-2026-054
7. Field Effect – FortiSandbox Vulnerabilities
8. TechTimes – FortiSandbox Exploited in Wild