What is the CVSS score of EUVD-2026-29550?

EUVD-2026-29550 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Fortinet FortiSandbox are affected by EUVD-2026-29550?

FortiSandbox 4.4.x through 5.0.x contains a critical remote code execution vulnerability (CVSS 9.8) that allows unauthenticated attackers to execute arbitrary commands through missing authorization…

How to fix or mitigate EUVD-2026-29550?

Within 24 hours: Identify and inventory all FortiSandbox deployments (versions 4.4.x-5.0.x) across on-premises, Cloud, and PaaS environments; isolate affected instances from production networks if operationally feasible. Within 7 days: Contact Fortinet support for patched version availability and timeline; review Fortinet advisory FG-IR-136 for interim mitigations; implement network segmentation to restrict HTTP access to FortiSandbox to trusted analyst networks only. Within 30 days: Deploy vendor-released patch immediately upon availability to all affected FortiSandbox instances; validate patch installation and conduct vulnerability rescans.

Fortinet FortiSandbox EUVD-2026-29550

| CVE-2026-26083 CRITICAL

Missing Authorization (CWE-862)

2026-05-12 fortinet

GHSA-5cw8-3wjv-7mvq

Authentication Bypass Fortinet Fortisandbox Cloud Fortisandbox Fortisandbox Paas

9.8

CVSS 3.1 · Vendor: fortinet

Severity by source

Vendor (fortinet) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (fortinet) · only source for this CVE.

CVSS VectorVendor: fortinet

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

May 12, 2026 - 18:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 12, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

May 12, 2026 - 18:22 NVD

9.1 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

May 12, 2026 - 18:00 vuln.today

CVE Published

May 12, 2026 - 16:54 nvd

CRITICAL 9.1

DescriptionCVE.org

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

AnalysisAI

Remote code execution in Fortinet FortiSandbox 4.4.x through 5.0.x (on-premises, Cloud, and PaaS deployments) allows unauthenticated attackers to execute arbitrary code or commands via crafted HTTP requests. This CWE-862 missing authorization flaw affects sandbox analysis appliances across multiple deployment models with CVSS 9.8 (critical) severity. Fortinet has published vendor advisory FG-IR-26-136. No CISA KEV listing or public POC identified at time of analysis, though the trivial attack complexity (AC:L) and network vector without authentication (PR:N) indicate high exploitability if technical details emerge.

Technical ContextAI

FortiSandbox is Fortinet's malware analysis and threat intelligence platform used to detonate suspicious files in isolated environments. This vulnerability stems from CWE-862 (Missing Authorization), meaning certain HTTP endpoints fail to verify caller permissions before executing privileged operations. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaw exists in network-accessible services with no authentication checks, likely in the web management interface or API layer. The affected CPE strings cover three distinct deployment models: cpe:2.3:a:fortinet:fortisandbox (on-premises appliances), cpe:2.3:a:fortinet:fortisandbox_cloud (cloud-hosted instances), and cpe:2.3:a:fortinet:fortisandbox_paas (platform-as-a-service). The breadth of affected versions (spanning releases from 21.3 through 5.0.5 depending on deployment model) suggests the authorization gap exists in core HTTP request handling code shared across all FortiSandbox variants.

RemediationAI

Apply vendor-released patches per Fortinet advisory FG-IR-26-136 at https://fortiguard.fortinet.com/psirt/FG-IR-26-136 which should specify fixed versions for each deployment model (specific patch versions not independently confirmed from available data). Until patching is complete, implement compensating controls: restrict HTTP/HTTPS access to FortiSandbox management interfaces to trusted administrative networks only via firewall rules or ACLs (blocks remote unauthenticated access vector); disable external access to Cloud/PaaS management APIs if not operationally required; monitor HTTP access logs for unusual POST/PUT requests to administrative endpoints; deploy network-based intrusion prevention signatures if available from Fortinet for this CVE. Note that access restrictions may impact legitimate remote administration workflows and require VPN or jump host access. For PaaS deployments, coordinate remediation timeline with Fortinet as patching may be vendor-managed.