CVE-2026-26083

· CVE-2026-26083: A remote, unauthenticated attacker without any privileges or user interaction can exploit this critical vulnerability in the GUI of FortiSandbox to use HTTP requests to execute unauthorized code. This vulnerability stems from missing authorization. · CVE-2025-53844: A remote, authenticated attacker with low privileges and without user interaction can use custom crafted packets to exploit this high criticality vulnerability in the capwap daemon of the FortiOS to gain execution privileges on the Fortigate device and execute unauthorized code. This vulnerability stems from an out-of-bounds write. · CVE-2025-53870, CVE-2025-53680: An authenticated attacker in the local network, can use specially crafted cli commands to exploit one of these two medium criticality vulnerabilities in FortiAP and FortiAP-W2 to elevate their privileges and execute commands without authorization. These vulnerabilities stem from improper neutralization of special elements used in an os command. · CVE-2025-67604: A remote, authenticated attacker can use custom HTTP requests to exploit this medium criticality vulnerability in FortiManager API and FortiAnalyzer to make the sustem crash and cause Denial of Service. This can only occur if there is an alignment of internal locks, which is not controlable by the attacker. This vulnerability stems from the use of potentially Dangerous Function.

EPSS 0.06% · 20.3th percentile