EUVD-2026-22333Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection.
AnalysisAI
Insufficiently protected credentials in Fortinet FortiSandbox 5.0.0-5.0.5, 4.4.x, and FortiSandbox PaaS 5.0.1-5.0.5 allow authenticated administrators to read LDAP server credentials via client-side inspection. This low-severity information disclosure requires high-privilege authentication and network access, exposing only credential confidentiality without enabling modification or denial of service.
Technical ContextAI
FortiSandbox is Fortinet's malware analysis and sandboxing platform. The vulnerability resides in the handling of LDAP authentication credentials within the administrative interface, specifically affecting the client-side rendering or storage of LDAP server connection details. The root cause is classified as CWE-522 (Insufficiently Protected Credentials), indicating that sensitive authentication material is inadequately safeguarded against unauthorized disclosure. Authenticated administrators with access to the web UI can inspect client-side code, cached data, or unencrypted credential fields to extract plaintext or weakly obfuscated LDAP credentials. The CPE identifiers cpe:2.3:a:fortinet:fortisandbox and cpe:2.3:a:fortinet:fortisandbox_paas confirm that both standalone FortiSandbox appliances and the cloud-based PaaS variant are affected across multiple version families.
RemediationAI
Upgrade FortiSandbox to a patched version provided by Fortinet; consult FG-IR-26-113 (https://fortiguard.fortinet.com/psirt/FG-IR-26-113) for exact fixed versions. For PaaS customers, Fortinet will manage patches automatically; on-premises customers must apply the vendor-released update to their deployment. As an interim workaround, restrict administrative console access to trusted networks and review LDAP credential configurations via secure administrative practices. If LDAP credentials are exposed, rotate the LDAP service account password immediately to prevent unauthorized directory access.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today