# Fortinet RCE flaws in FortiAuthenticator and FortiSandbox

Published: 2026-05-12 · Severity: high · Sectors: government-national, financial-services, healthcare, energy, infrastructure
Canonical: https://vorant.io/reports/5669a91b-27a4-54cc-b3ae-47729071330b/fortinet-rce-flaws-in-fortiauthenticator-and-fortisandbox

> Two unauthenticated remote code execution vulnerabilities affect Fortinet FortiAuthenticator and FortiSandbox products, exploitable via crafted HTTP requests.

Fortinet has disclosed two vulnerabilities in its FortiAuthenticator and FortiSandbox product lines that could allow unauthenticated attackers to execute arbitrary code remotely. CVE-2026-44277 is an improper access control flaw in FortiAuthenticator that permits code execution via crafted requests. CVE-2026-26083 is a missing authorization vulnerability in the FortiSandbox web UI across its on-premises, cloud, and PaaS variants, exploitable through HTTP requests. Both vulnerabilities require no authentication and could lead to full system compromise.

The MS-ISAC advisory rates these vulnerabilities as high risk for government and business environments. Fortinet has released patches: FortiAuthenticator 8.0.3 and later, and FortiSandbox 5.0.2 and later (5.0.6 for Cloud variant). There are currently no reports of active exploitation in the wild. Organizations are advised to apply patches immediately after testing and implement defense-in-depth measures including network segmentation, privilege restrictions, and vulnerability scanning.

## Mentioned in this report

- Vulnerabilities: CVE-2026-26083, CVE-2026-44277

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Web Service on Fortinet Appliance

ATT&CK: T1190

Detects a shell or scripting interpreter spawned by a web-facing service process, consistent with post-exploitation of an unauthenticated RCE flaw such as CVE-2026-44277 or CVE-2026-26083 against FortiAuthenticator/FortiSandbox web UI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Web Service on Fortinet Appliance
id: 2e67ec6e-ac44-5f81-a4c4-92318cb105e1
status: experimental
description: 'Detects command interpreters or shells spawned as child processes of
  a web server / application process,

  which may indicate successful exploitation of an unauthenticated remote code execution
  vulnerability

  such as those disclosed for FortiAuthenticator (CVE-2026-44277) or FortiSandbox
  (CVE-2026-26083), where

  crafted HTTP requests to the management web UI lead to arbitrary code execution.

  '
references:
- https://www.fortiguard.com/psirt
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - /httpd
    - /nginx
    - /apache
    - /tomcat
    - /java
    Image|endswith:
    - /bash
    - /sh
    - /dash
    - /python
    - /python3
    - /perl
    - /wget
    - /curl
    - /nc
    - /ncat
  filter:
    CommandLine|contains:
    - /usr/local/bin/healthcheck
    - logrotate
  condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or health-check utilities invoked by the web server
  process
- Custom application logic that intentionally shells out for maintenance tasks
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2026-049

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5669a91b-27a4-54cc-b3ae-47729071330b/fortinet-rce-flaws-in-fortiauthenticator-and-fortisandbox.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup