Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-26084 (GCVE-0-2026-26084)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:41 – Updated: 2026-09-08 17:31
VLAI
EPSS
VEX
Summary
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:31 UTC
CWE
- CWE-284 - Improper access control
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Fortinet | FortiSandbox PaaS |
Affected:
5.0.4 , ≤ 5.0.5
(semver)
cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:* |
||
| Fortinet | FortiSandbox |
Affected:
5.0.0 , ≤ 5.0.5
(semver)
Affected: 4.4.0 , ≤ 4.4.8 (semver) Affected: 4.2.1 , ≤ 4.2.8 (semver) cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:* |
||
| Fortinet | FortiSandbox Cloud |
Affected:
5.0.4 , ≤ 5.0.5
(semver)
cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-26084",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:31:09.979157Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:31:37.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox PaaS",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.5",
"status": "affected",
"version": "5.0.4",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.5",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.8",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.8",
"status": "affected",
"version": "4.2.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox Cloud",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.5",
"status": "affected",
"version": "5.0.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper access control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:41:47.842Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-166",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-166"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiSandbox version 5.2.0 or above\nUpgrade to FortiSandbox version 5.0.6 or above\nUpgrade to FortiSandbox version 4.4.9 or above\nUpgrade to FortiSandbox Cloud version 5.0.6 or above\nUpgrade to FortiSandbox PaaS version 5.2.0 or above\nUpgrade to FortiSandbox PaaS version 5.0.6 or above\nUpgrade to FortiSandbox PaaS version 4.4.9 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2026-26084",
"datePublished": "2026-09-08T16:41:47.842Z",
"dateReserved": "2026-02-11T09:32:22.258Z",
"dateUpdated": "2026-09-08T17:31:37.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-26084",
"date": "2026-09-09",
"epss": "0.00238",
"percentile": "0.14834"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-26084\",\"sourceIdentifier\":\"psirt@fortinet.com\",\"published\":\"2026-09-08T17:17:34.590\",\"lastModified\":\"2026-09-08T18:35:10.323\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.\"}],\"affected\":[{\"source\":\"psirt@fortinet.com\",\"affectedData\":[{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox PaaS\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.0.4\",\"lessThanOrEqual\":\"5.0.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.0.0\",\"lessThanOrEqual\":\"5.0.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.0\",\"lessThanOrEqual\":\"4.4.8\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.2.1\",\"lessThanOrEqual\":\"4.2.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox Cloud\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.0.4\",\"lessThanOrEqual\":\"5.0.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.3}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-08T17:31:09.979157Z\",\"id\":\"CVE-2026-26084\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://fortiguard.fortinet.com/psirt/FG-IR-26-166\",\"source\":\"psirt@fortinet.com\"}]}}"
}
}
FKIE_CVE-2026-26084
Vulnerability from fkie_nvd - Published: 2026-09-08 17:17 - Updated: 2026-09-08 18:35
Severity
Summary
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox PaaS",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.5",
"status": "affected",
"version": "5.0.4",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.5",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.8",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.8",
"status": "affected",
"version": "4.2.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox Cloud",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.0.5",
"status": "affected",
"version": "5.0.4",
"versionType": "semver"
}
]
}
],
"source": "psirt@fortinet.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests."
}
],
"id": "CVE-2026-26084",
"lastModified": "2026-09-08T18:35:10.323",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.3,
"source": "psirt@fortinet.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-26084",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:31:09.979157Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-08T17:17:34.590",
"references": [
{
"source": "psirt@fortinet.com",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-166"
}
],
"sourceIdentifier": "psirt@fortinet.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "psirt@fortinet.com",
"type": "Secondary"
}
]
}
GHSA-PG7F-VWCX-MR45
Vulnerability from github – Published: 2026-09-08 18:31 – Updated: 2026-09-08 18:31
VLAI
Details
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.
Severity
9.9 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-26084"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T17:17:34Z",
"severity": "CRITICAL"
},
"details": "A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.",
"id": "GHSA-pg7f-vwcx-mr45",
"modified": "2026-09-08T18:31:55Z",
"published": "2026-09-08T18:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26084"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-166"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
NCSC-2026-0355
Vulnerability from csaf_ncscnl - Published: 2026-09-09 10:40 - Updated: 2026-09-09 10:40Summary
Kwetsbaarheden verholpen in Fortinet Forti-producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Fortinet heeft kwetsbaarheden verholpen in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM en FortiSOAR.
Interpretaties: De kwetsbaarheden betreffen verschillende typen fouten in meerdere Fortinet-producten.
De ernstigste kwetsbaarheid met kenmerk CVE-2026-26084 heeft een CVSS-score van 8,9. Het betreft een autorisatiekwetsbaarheid in Fortinet FortiSandbox waardoor een ongeauthenticeerde kwaadwillende via speciaal vervaardigde HTTP-verzoeken toegang kan krijgen tot gevoelige informatie. De kwetsbaarheid vereist geen gebruikersinteractie en kan via het netwerk worden misbruikt.
Oplossingen: Fortinet heeft updates uitgebracht om de kwetsbaarheden in FortiOS, FortiPAM , FortiProxy, FortiAnalyser, FortiSandbox, FortiMonitor en FortiManager te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-283: Unverified Ownership
CWE-297: Improper Validation of Certificate with Host Mismatch
CWE-457: Use of Uninitialized Variable
CWE-476: NULL Pointer Dereference
CWE-540: Inclusion of Sensitive Information in Source Code
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer versions 7.6.3 through 7.6.6, specifically in the SNMP daemon, may allow a remote authenticated user to cause a denial of service via SNMP GETBULK requests.
CWE-457 - Use of Uninitialized VariableAffected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
A NULL Pointer Dereference vulnerability in Fortinet FortiOS, FortiPAM, and FortiProxy allows an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
CWE-476 - NULL Pointer DereferenceAffected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
An improper access control vulnerability in Fortinet FortiSandbox WEB UI allows unauthenticated attackers to access sensitive information via crafted HTTP requests.
9.9 (Critical)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
Fortinet FortiSandbox versions 4.4.0 to 5.2.0 contain a command injection vulnerability due to improper neutralization of special elements, allowing privileged attackers to execute unauthorized code via crafted HTTP requests.
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
An improper access control vulnerability in Fortinet FortiManager and FortiManager Cloud allows administrators to bypass the workflow session approval process via crafted HTTP or HTTPS requests.
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
Fortinet FortiOS 7.6.1 to 7.6.6 and FortiProxy 7.6.2 to 7.6.6 contain improper certificate validation vulnerabilities that may allow remote attackers to disclose information or perform Man-in-the-Middle attacks on ZTNA portal communications.
CWE-297 - Improper Validation of Certificate with Host MismatchAffected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
A vulnerability in the FortiMonitorOnSight web portal allows remote unauthenticated attackers to bypass authentication by exploiting sensitive information exposure in source code and using forged or reused JWT tokens.
9.8 (Critical)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
Fortinet FortiClient Windows versions 7.2 and 7.4.0 through 7.4.7 contain an unverified ownership vulnerability in the fortimon3 driver that may allow authenticated attackers to terminate arbitrary processes via an exposed minifilter communication port.
CWE-283 - Unverified OwnershipAffected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
Fortinet FortiSIEM versions 7.4.1 to 7.5.1 contain a URL redirection vulnerability (CWE-601) that allows authenticated attackers to redirect users to arbitrary websites and potentially execute unauthorized code or commands.
CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
Multiple versions of Fortinet FortiSOAR PaaS and on-premise products contain an improper access control vulnerability allowing authenticated attackers with no permissions to escalate privileges and inject broadcast messages via crafted websocket requests.
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Fortinet / FortiAnalyzer
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiClientWindows
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiManager Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiMonitor OnSight
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiOS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiPAM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiProxy
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSIEM
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSOAR on-premise
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / FortiSandbox PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
Fortinet / Fortimonitor_Onsight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiMonitorOnSight
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiPAM Chrome Extension
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSOAR PaaS
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox Cloud
|
vers:unknown/* | ||
|
vers:unknown/*
fortinet / FortiSandbox PaaS
|
vers:unknown/* |
References
20 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Fortinet heeft kwetsbaarheden verholpen in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM en FortiSOAR.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen verschillende typen fouten in meerdere Fortinet-producten. \n\nDe ernstigste kwetsbaarheid met kenmerk CVE-2026-26084 heeft een CVSS-score van 8,9. Het betreft een autorisatiekwetsbaarheid in Fortinet FortiSandbox waardoor een ongeauthenticeerde kwaadwillende via speciaal vervaardigde HTTP-verzoeken toegang kan krijgen tot gevoelige informatie. De kwetsbaarheid vereist geen gebruikersinteractie en kan via het netwerk worden misbruikt.\n\n",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Fortinet heeft updates uitgebracht om de kwetsbaarheden in FortiOS, FortiPAM , FortiProxy, FortiAnalyser, FortiSandbox, FortiMonitor en FortiManager te verhelpen. Zie bijgevoegde referenties voor meer informatie.\n\n",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "general",
"text": "Unverified Ownership",
"title": "CWE-283"
},
{
"category": "general",
"text": "Improper Validation of Certificate with Host Mismatch",
"title": "CWE-297"
},
{
"category": "general",
"text": "Use of Uninitialized Variable",
"title": "CWE-457"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Inclusion of Sensitive Information in Source Code",
"title": "CWE-540"
},
{
"category": "general",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-164"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-165"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-166"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-167"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-169"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-170"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-171"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-172"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-173"
},
{
"category": "external",
"summary": "Reference",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-174"
}
],
"title": "Kwetsbaarheden verholpen in Fortinet Forti-producten",
"tracking": {
"current_release_date": "2026-09-09T10:40:23.373365Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0355",
"initial_release_date": "2026-09-09T10:40:23.373365Z",
"revision_history": [
{
"date": "2026-09-09T10:40:23.373365Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "FortiAnalyzer"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "FortiClientWindows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "FortiManager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "FortiManager Cloud"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "FortiMonitor"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "FortiMonitor OnSight"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "FortiOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "FortiPAM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "FortiProxy"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "FortiSIEM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "FortiSOAR PaaS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "FortiSOAR on-premise"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "FortiSandbox"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "FortiSandbox Cloud"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "FortiSandbox PaaS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "Fortimonitor_Onsight"
}
],
"category": "vendor",
"name": "Fortinet"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "FortiMonitorOnSight"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "FortiPAM Chrome Extension"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "FortiSOAR PaaS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-20"
}
}
],
"category": "product_name",
"name": "FortiSandbox Cloud"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-21"
}
}
],
"category": "product_name",
"name": "FortiSandbox PaaS"
}
],
"category": "vendor",
"name": "fortinet"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-84391",
"cwe": {
"id": "CWE-457",
"name": "Use of Uninitialized Variable"
},
"notes": [
{
"category": "other",
"text": "Use of Uninitialized Variable",
"title": "CWE-457"
},
{
"category": "description",
"text": "A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer versions 7.6.3 through 7.6.6, specifically in the SNMP daemon, may allow a remote authenticated user to cause a denial of service via SNMP GETBULK requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84391 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84391.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84391"
},
{
"cve": "CVE-2026-84392",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A NULL Pointer Dereference vulnerability in Fortinet FortiOS, FortiPAM, and FortiProxy allows an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84392 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84392.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84392"
},
{
"cve": "CVE-2026-26084",
"notes": [
{
"category": "description",
"text": "An improper access control vulnerability in Fortinet FortiSandbox WEB UI allows unauthenticated attackers to access sensitive information via crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-26084 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-26084.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-26084"
},
{
"cve": "CVE-2026-84387",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "description",
"text": "Fortinet FortiSandbox versions 4.4.0 to 5.2.0 contain a command injection vulnerability due to improper neutralization of special elements, allowing privileged attackers to execute unauthorized code via crafted HTTP requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84387 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84387.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84387"
},
{
"cve": "CVE-2026-22575",
"notes": [
{
"category": "description",
"text": "An improper access control vulnerability in Fortinet FortiManager and FortiManager Cloud allows administrators to bypass the workflow session approval process via crafted HTTP or HTTPS requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-22575 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22575.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-22575"
},
{
"cve": "CVE-2026-84393",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Certificate with Host Mismatch",
"title": "CWE-297"
},
{
"category": "description",
"text": "Fortinet FortiOS 7.6.1 to 7.6.6 and FortiProxy 7.6.2 to 7.6.6 contain improper certificate validation vulnerabilities that may allow remote attackers to disclose information or perform Man-in-the-Middle attacks on ZTNA portal communications.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84393 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84393.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84393"
},
{
"cve": "CVE-2026-84390",
"notes": [
{
"category": "description",
"text": "A vulnerability in the FortiMonitorOnSight web portal allows remote unauthenticated attackers to bypass authentication by exploiting sensitive information exposure in source code and using forged or reused JWT tokens.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84390 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84390.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84390"
},
{
"cve": "CVE-2026-84386",
"cwe": {
"id": "CWE-283",
"name": "Unverified Ownership"
},
"notes": [
{
"category": "other",
"text": "Unverified Ownership",
"title": "CWE-283"
},
{
"category": "description",
"text": "Fortinet FortiClient Windows versions 7.2 and 7.4.0 through 7.4.7 contain an unverified ownership vulnerability in the fortimon3 driver that may allow authenticated attackers to terminate arbitrary processes via an exposed minifilter communication port.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84386 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84386.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84386"
},
{
"cve": "CVE-2026-84389",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"notes": [
{
"category": "other",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "description",
"text": "Fortinet FortiSIEM versions 7.4.1 to 7.5.1 contain a URL redirection vulnerability (CWE-601) that allows authenticated attackers to redirect users to arbitrary websites and potentially execute unauthorized code or commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84389 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84389.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84389"
},
{
"cve": "CVE-2026-84385",
"notes": [
{
"category": "description",
"text": "Multiple versions of Fortinet FortiSOAR PaaS and on-premise products contain an improper access control vulnerability allowing authenticated attackers with no permissions to escalate privileges and inject broadcast messages via crafted websocket requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84385 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84385.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-84385"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…