FG-IR-26-166: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
Published Sep 8, 2026
·Updated
An improper access control vulnerability [CWE-284] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests.
Affected Software
4 affected componentsFixes available
Fortinet FortiSandbox>=5.0.0<=5.0.5
Fortinet FortiSandbox>=4.4.0<=4.4.8
Fortinet FortiSandbox Cloud>=5.0.4<=5.0.5
Fortinet FortiSandbox PaaS>=5.0.4<=5.0.5
Event History
Sep 8, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which deployments are exposed to this issue?
The affected products are FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS, specifically through their WEB UI.
2
What does an attacker need to exploit the vulnerability?
The issue can be exploited remotely through crafted HTTP requests. No authentication or user interaction is required.
3
What is the likely impact of successful exploitation?
An unauthenticated attacker may access sensitive information. The supplied severity vector also indicates potential impacts to confidentiality, integrity, and availability.