What is the CVSS score of CVE-2026-59835?

CVE-2026-59835 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of FortiSandbox are affected by CVE-2026-59835?

Fortinet FortiSandbox deployments running affected versions (4.4.3-4.4.8, 5.0.0-5.0.2) expose live malware analysis environments to remote unauthenticated access, allowing attackers to observe…

How to fix or mitigate CVE-2026-59835?

Within 24 hours, inventory all FortiSandbox instances running versions 4.4.3-4.4.8 or 5.0.0-5.0.2 and document current network exposure and usage patterns. Within 7 days, deploy firewall rules restricting VNC access (ports 5900-5910) to authorized analyst workstations only, implement network segmentation to isolate affected sandbox infrastructure from untrusted networks, and disable remote VNC service when not actively in use. Within 30 days, contact Fortinet to confirm patch status and timeline, evaluate and plan migration to patched versions, and document workaround effectiveness for inclusion in your remediation roadmap.

FortiSandbox CVE-2026-59835

EUVD-2026-43710 HIGH

Exposure of Resource to Wrong Sphere (CWE-668)

2026-07-14 fortinet

GHSA-8fjf-5954-r8w4

Information Disclosure Fortinet Fortisandbox

8.6

CVSS 3.1 · Vendor: fortinet

Severity by source

Vendor (fortinet) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

8.6 HIGH

Unauthenticated network access to an exposed VNC service (AV:N/AC:L/PR:N) yields high confidentiality exposure of analysis sessions with limited integrity/availability impact via possible VM interaction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (fortinet).

CVSS VectorVendor: fortinet

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 16:50 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 14, 2026 - 16:48 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 16:22 NVD

7.7 (HIGH) 8.6 (HIGH)

Analysis Generated

Jul 14, 2026 - 16:03 vuln.today

CVE Published

Jul 14, 2026 - 15:12 cve.org

HIGH 7.7

DescriptionCVE.org

A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.

Articles & Coverage 1

News 4 New Fortinet Vulnerabilities - 4 High Severity Jul 15, 2026

AnalysisAI

Exposure of a scanning VM's VNC service in Fortinet FortiSandbox 5.0.0-5.0.2 and 4.4.3-4.4.8 lets an unauthenticated remote attacker reach the VNC server of the sandbox virtual machines used for malware detonation via ordinary network requests. Because these VMs run and observe live malware samples, unauthorized VNC access can expose sensitive analysis sessions and potentially allow interaction with the detonation environment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

FortiSandbox is Fortinet's automated malware analysis (detonation) appliance that spins up guest virtual machines to execute and observe suspicious files. Those guest VMs expose a VNC (Virtual Network Computing) remote-framebuffer service so the sandbox can drive and observe the desktop during scanning. This flaw is classified as CWE-668 (Exposure of Resource to the Wrong Sphere): the VNC endpoint of these internal scanning VMs is reachable from an unintended network sphere rather than being confined to the appliance's internal control plane, allowing outside parties to connect to a resource that was meant to be private to the analysis subsystem.

RemediationAI

Patch available per vendor advisory FG-IR-26-145 (https://fortiguard.fortinet.com/psirt/FG-IR-26-145) - upgrade FortiSandbox to a fixed release above the affected 5.0.2 and 4.4.8 branches as directed by Fortinet; the input data does not include an exact fixed version number, so confirm the target build directly from the advisory. As a compensating control until patched, restrict network reachability of the appliance by placing it in an isolated management VLAN and using firewall ACLs to block inbound access to the VNC service ports from any untrusted or user network segments, allowing only the sandbox's own control plane and trusted administrators; the trade-off is minimal since guest-VM VNC should never be exposed to general network traffic in normal operation. Avoid exposing the FortiSandbox management or scanning interfaces to the internet or flat internal networks.