Fortinet FortiSandbox Flaw Exposes Sensitive Information via Unauthenticated NAT Rule Control
A critical improper access control vulnerability in Fortinet's FortiSandbox products allows unauthenticated attackers to access sensitive information by manipulating NAT rules.
Fortinet has disclosed a critical vulnerability, identified as CWE-284, within its FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI. This flaw, carrying a CVSSv3 score of 8.9, permits unauthenticated attackers to gain access to sensitive information by sending specially crafted HTTP requests.
The vulnerability specifically targets the Network Address Translation (NAT) rule control mechanism. By exploiting this weakness, an attacker can potentially manipulate NAT rules to redirect traffic or expose internal network configurations and sensitive data that would otherwise be protected. The lack of authentication required to trigger this exploit significantly increases its risk profile.
While the advisory does not specify the exact nature of the sensitive information that could be exposed, such vulnerabilities often lead to the disclosure of internal system details, configuration parameters, or potentially even user data depending on the context of the NAT rules and the surrounding system architecture.
Fortinet has provided a security advisory, FG-IR-26-166, detailing the affected products and versions. Users of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS are strongly urged to review the advisory and apply any available updates or mitigations recommended by Fortinet to protect their environments.
The disclosure highlights a recurring theme in cybersecurity where improper access controls in management interfaces can lead to significant data exposure. Attackers continuously probe for such weaknesses, especially in security appliances like sandboxes, which often handle sensitive network traffic and configurations.
Organizations deploying FortiSandbox solutions should prioritize assessing their exposure to this vulnerability. This includes verifying the versions of their deployed instances and implementing the recommended security patches or workarounds provided by Fortinet. Proactive security hygiene remains paramount in mitigating the impact of such critical flaws.
This new advisory for CVE-2026-26084 details an improper access control vulnerability in the web interface of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. While the previously reported flaw (CVE-2026-XXXX) focused on manipulating NAT rules for information disclosure, this vulnerability specifically targets the graphical user interface component, allowing unauthenticated attackers to craft HTTP requests to access sensitive configurations and logs. The CVSS score is 8.9, and affected versions for on-premises deployments include FortiSandbox 5.0.0-5.0.5 and 4.4.0-4.4.8, with specific ranges also noted for cloud and PaaS variants.