Reported by 3 outlets
FortiSandbox unauthenticated information disclosure via crafted HTTP requests
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
FortiSandbox information disclosure CVE-2026-26084 allows unauthenticated remote attackers to access sensitive data through crafted HTTP requests to the web interface. The flaw affects FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS; CVSS v3.1 is 8.9 and the weakness is CWE-284 improper access control in a shared GUI component. Fortinet's advisory FG-IR-26-166 covers the vulnerability. A network-based attack requires no user interaction, making exposed management interfaces a particular concern. The new event from dev.to (CVE-2026-26084) notes it is easy to deprioritize relative to remote exploitation, confirming no active exploitation claim here. Defenders should apply the vendor fix and restrict interface exposure.
Timeline
-
original reporting
FortiSandbox Flaw Lets Unauthenticated Attackers Access Sensitive Information via Crafted HTTP Requests
cyberpress.org · 34d ago · September 9th, 2026
Fortinet has disclosed a high-severity vulnerability in its FortiSandbox product line that could allow unauthenticated attackers to access sensitive information by sending specially crafted HTTP requests to the platform’s web interface. Tracked as CVE-2026-26084, the flaw affects FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS deployments. Fortinet assigned the issue a CVSS v3.1 score of 8.9, reflecting the potential impact of an attacker accessing operational data without valid credentials, user interaction, or prior privileges. FortiSandbox Flaw According to Fortinet’s security advisory , CVE-2026-26084 is an improper access control vulnerability classified as CWE-284. The weakness exists in a graphical user interface component shared across affected FortiSandbox deployments. In practice, the issue means the FortiSandbox web interface may not adequately validate whether an HTTP request originates from an authenticated, authorized session before exposing protected information. An attacker familiar with the application’s internal API structure could send crafted requests directly to vulnerable endpoints and potentially bypass normal authentication controls. The vulnerability has a network-based attack vector and requires no user interaction, making internet-exposed or insufficiently segmented management interfaces a particular concern. Although Fortinet has not described the precise data accessible through exploitation, exposed information could include system configu
-
update from gbhackers.com
Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information
gbhackers.com · 34d ago · September 9th, 2026
It affects the graphical user interface (GUI) component of FortiSandbox, FortiSandbox […] The post Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from dev.to
CVE-2026-26084: the sandbox appliance that answers questions it should refuse Information disclosure is easy to deprioritize next to remote
dev.to · 16d ago · September 28th, 2026
CVE-2026-26084: the sandbox appliance that answers questions it should refuse Information disclosure is easy to deprioritize next to remote
via Mastodon https://dev.to/bianliang/cve-2026-26084-the-sandbox-appliance-that-answers-questions-it-should-refuse-5a1b