Fortinet RCE flaws in FortiAuthenticator and FortiSandbox
Two unauthenticated remote code execution vulnerabilities affect Fortinet FortiAuthenticator and FortiSandbox products, exploitable via crafted HTTP requests.
Fortinet has disclosed two vulnerabilities in its FortiAuthenticator and FortiSandbox product lines that could allow unauthenticated attackers to execute arbitrary code remotely. CVE-2026-44277 is an improper access control flaw in FortiAuthenticator that permits code execution via crafted requests. CVE-2026-26083 is a missing authorization vulnerability in the FortiSandbox web UI across its on-premises, cloud, and PaaS variants, exploitable through HTTP requests. Both vulnerabilities require no authentication and could lead to full system compromise.
The MS-ISAC advisory rates these vulnerabilities as high risk for government and business environments. Fortinet has released patches: FortiAuthenticator 8.0.3 and later, and FortiSandbox 5.0.2 and later (5.0.6 for Cloud variant). There are currently no reports of active exploitation in the wild. Organizations are advised to apply patches immediately after testing and implement defense-in-depth measures including network segmentation, privilege restrictions, and vulnerability scanning.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Web Service on Fortinet Appliance
Detects a shell or scripting interpreter spawned by a web-facing service process, consistent with post-exploitation of an unauthenticated RCE flaw such as CVE-2026-44277 or CVE-2026-26083 against FortiAuthenticator/FortiSandbox web UI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Web Service on Fortinet Appliance
id: 2e67ec6e-ac44-5f81-a4c4-92318cb105e1
status: experimental
description: 'Detects command interpreters or shells spawned as child processes of
a web server / application process,
which may indicate successful exploitation of an unauthenticated remote code execution
vulnerability
such as those disclosed for FortiAuthenticator (CVE-2026-44277) or FortiSandbox
(CVE-2026-26083), where
crafted HTTP requests to the management web UI lead to arbitrary code execution.
'
references:
- https://www.fortiguard.com/psirt
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- /httpd
- /nginx
- /apache
- /tomcat
- /java
Image|endswith:
- /bash
- /sh
- /dash
- /python
- /python3
- /perl
- /wget
- /curl
- /nc
- /ncat
filter:
CommandLine|contains:
- /usr/local/bin/healthcheck
- logrotate
condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or health-check utilities invoked by the web server
process
- Custom application logic that intentionally shells out for maintenance tasks
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2026-049
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free