Fortinet FortiSandbox EUVD-2026-72926

No special conditions are required beyond network reachability of the FortiSandbox HTTP/HTTPS management or API interface. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated exploitation with no special configuration, no user interaction, and no elevated complexity required - this is a default-configuration attack against the exposed web service. Exploitation is bounded by network access: organizations that restrict the FortiSandbox management interface to internal networks or VPN segments significantly reduce exposure, as the attacker must be able to reach the HTTP endpoint. The 4.2.x branch is flagged as affected by EUVD but omitted from the NVD CVE description; 4.2.x administrators should verify their exposure against the Fortinet PSIRT advisory before assuming they are unaffected. Cloud and PaaS deployments in the 5.0.4-5.0.5 range are confirmed in scope.

The vendor-confirmed CVSS 3.1 base score of 8.9 (High) reflects the most dangerous combination of base metrics: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and scope changed (S:C) - effectively unauthenticated remote exploitation with cascading impact. The temporal metrics sharpen the urgency considerably: E:P confirms proof-of-concept exploit code already exists, RL:O confirms an official patch is available, and RC:C confirms the vulnerability. Even a mid-sized municipal IT team in kielce running FortiSandbox to analyze employee email attachments should treat this as urgent, given that sandboxing platforms process highly sensitive data - submitted files, behavioral reports, potentially confidential enterprise documents - and a successful access control bypass could expose all of it. One tension in the data must be flagged: the CVE description characterizes this purely as an information-access issue, yet the vendor CVSS assigns A:H (high availability impact) and I:L (integrity impact) in addition to C:L - these additional impacts exceed what a read-only information disclosure scenario would typically produce, and the mechanism driving A:H is unexplained in the description. Organizations should consult the full FG-IR-26-166 advisory to understand whether availability disruption is a primary attack path or a secondary consequence. EPSS data was not supplied in the input; exploitation probability cannot be formally quantified, but the combination of zero-complexity network attack and confirmed PoC makes opportunistic scanning of exposed management interfaces plausible.

An unauthenticated attacker with network access to the FortiSandbox web or API interface sends carefully crafted HTTP requests targeting one or more access-controlled endpoints. The improper access control flaw fails to verify the caller's identity or authorization level, returning sensitive sandbox data - analysis reports, submitted file information, or internal configuration - and potentially triggering service disruption. Proof-of-concept exploit code is confirmed to exist (E:P), indicating the attack path has been demonstrated and documented outside the vendor.