Critical Fortinet vulnerabilities fixed in FortiSandbox and FortiAuthenticator
May 13, 2026 
Fortinet patched critical flaws in FortiSandbox and FortiAuthenticator that could let attackers remotely execute code on unpatched systems.
Fortinet addressed two critical vulnerabilities affecting FortiSandbox and FortiAuthenticator. The flaws could allow attackers to execute arbitrary commands or code on unpatched systems.
The first vulnerability, tracked as CVE-2026-44277, is an improper access control issue in FortiAuthenticator.
“An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.” reads the advisory.
Below are the impacted versions:
| Version | Affected | Solution |
|---|---|---|
| FortiAuthenticator 8.0 | 8.0.2 | Upgrade to 8.0.3 or above |
| FortiAuthenticator 8.0 | 8.0.0 | Upgrade to 8.0.3 or above |
| FortiAuthenticator 6.6 | 6.6.0 through 6.6.8 | Upgrade to 6.6.9 or above |
| FortiAuthenticator 6.5 | 6.5.0 through 6.5.6 | Upgrade to 6.5.7 or above |
The vulnerability doesn’t affect FortiAuthenticator Cloud.
Fortinet experts discovered the flaw as part of an internal audit.
The second flaw addressed by the cybersecurity vendor is a missing authorization issue, tracked as CVE-2026-26083, in FortiSandbox. An attacker can trigger the flaw to achieve remote code execution on vulnerable systems.
“A missing authorization vulnerability [CWE-862] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.” reads the advisory.
Neither flaw has been exploited in in-the-wild attacks.
Adham El Karn from the Fortinet Product Security team discovered and reported the issue internally.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, FortiAuthenticator)
