Organization

Fortinet PSIRT

1 mentions in 7 days · 1 in 30 days · 4 total · first seen Aug 12, 2026 · last 6d ago

Timeline4 articles

Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information

Fortinet fixed CVE-2026-26084, an unauthenticated access-control flaw in FortiSandbox GUI rated 8.9 CVSS, with no known exploitation yet.

Fortinet disclosed CVE-2026-26084 (advisory FG-IR-26-166), a CWE-284 improper access control flaw in the GUI of FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS, rated 8.9 CVSS v3.1. An unauthenticated remote attacker can send specially crafted HTTP requests to control NAT rules and expose sensitive information. Affected versions include FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 (plus Cloud/PaaS 5.0.4-5.0.5), fixed in 4.4.9 and 5.0.6. Fortinet researcher Adham El Karn found the flaw internally and the September 8 advisory reports no known exploitation.

GBHackersSep 9, 07:15 UTC · 6d agoVulnerability 2 sources CVE-2026-26084

HTTP/2 Bomb CVE-2026-49975

Fortinet advisory details CVE-2026-49975, an Apache HTTP Server HTTP/2 flaw enabling denial of service, affecting versions 2.4.17 through 2.4.67.

Fortinet PSIRT advisory FG-IR-26-163, revised 2026-08-19, covers CVE-2026-49975, a memory allocation with excessive size value flaw (HTTP/2 bomb) in Apache HTTP Server's mod_http2, scored CVSSv3 5.8. Malicious HTTP requests can cause a denial of service, and affected versions span Apache HTTP Server 2.4.17 through 2.4.67. The advisory text does not state which Fortinet product bundles the affected Apache component or whether exploitation has been observed.

Fortinet PSIRTAug 12, 07:00 UTC · Aug 12, 2026Advisory CVE-2026-49975

Heap overflow in kernel driver due to missing size validation

Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.

Fortinet PSIRT advisory FG-IR-26-156, revised 2026-08-12, describes a heap-based buffer overflow (CWE-120, buffer copy without checking input size) in the FortiClient Windows kernel driver, scored CVSSv3 7.3. An unauthenticated attacker positioned to alter or craft DNS responses for a targeted host could execute arbitrary code via malicious packets. No CVE identifier or exploitation status is provided in the advisory text, so administrators should check the full bulletin for affected versions and fixed releases.

Fortinet PSIRTAug 12, 07:00 UTC · Aug 12, 2026Advisory

Server-Side Request Forgery (SSRF)

Fortinet discloses a low-severity SSRF in the FortiSIEM GUI allowing authenticated attackers to send requests from targeted devices.

Fortinet PSIRT advisory FG-IR-26-159, revised 2026-08-12, describes a server-side request forgery (CWE-918) in the FortiSIEM GUI, scored CVSSv3 3.4. An authenticated attacker can send HTTP requests originating from the targeted device via specially crafted requests, potentially enabling internal network probing. No CVE identifier or exploitation status is included in the advisory text.

Fortinet PSIRTAug 12, 07:00 UTC · Aug 12, 2026Advisory

Related CVEsby mentions

CVE-2026-260849.9<1%
Improper Access Control in Fortinet FortiSandbox Exposes Sensitive Data
CVE-2026-26084 is an improper access control flaw (CWE-284) in the web interface of Fortinet's FortiSandbox threat-analysis product line, affecting on-premises 4.4.x and 5.0.x releases as well as the FortiSandbox Cloud and PaaS offerings. An unauthenticated attacker can trigger it remotely by sending crafted HTTP requests to the affected FortiSandbox web service, bypassing access controls without needing credentials or user interaction. A successful attacker gains access to sensitive information handled by the appliance; Fortinet's critical 9.9 CVSS score also reflects a scope change with a high availability-impact component, so defenders should treat the practical impact as potentially broader than simple information disclosure. Any organization running affected versions of FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS is in scope, though the product's enterprise appliance/cloud deployment model means the affected population is far smaller than endpoint or firewall software. There is no evidence of exploitation so far: the flaw is not in CISA KEV, has no known public proof-of-concept, and EPSS assigns roughly a 0.2% probability of exploitation within 30 days.
· Fortinet FortiSandbox 5.0.0 through 5.0.5 · Fortinet FortiSandbox 4.4.0 through 4.4.8moderate
CVE-2026-499757.534%
Unauthenticated DoS via excessive memory allocation in Apache HTTP Server (HTTP/2 'bomb')
CVE-2026-49975 is a memory-allocation flaw (CWE-789, 'Memory Allocation with Excessive Size Value', with related data-amplification handling per CWE-409) in Apache HTTP Server's mod_http module; related press coverage characterizes it as an HTTP/2 'bomb'. An unauthenticated remote attacker triggers it by sending malicious HTTP requests that cause the server to allocate memory with an excessively large size, and the practical impact is denial of service — availability loss with no direct confidentiality or integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability impact high). It affects Apache HTTP Server 2.4.17 through 2.4.67, and the advisory data also lists Debian Linux as affected through its shipped Apache packages (specific Debian releases are not specified). Exploitation has not been confirmed in the wild and the flaw is not in CISA's KEV catalog, but a public proof-of-concept exists (github.com/EQSTLab/CVE-2026-49975) and EPSS assigns a 31% probability of exploitation within 30 days (98th percentile), so near-term exploitation is plausible.
· apache http server 2.4.17 through 2.4.67 (inclusive) · debian linux PoC mass

Appears with

vendor Fortinet 4 product Apache HTTP Server 1 product FortiClient Windows 1 organization Apache Software Foundation 1 product FortiSIEM 1 vendor Apache Software Foundation 1 product FortiSandbox 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.