Fortinet addressed two critical vulnerabilities affecting FortiSandbox and FortiAuthenticator. The flaws could allow attackers to execute arbitrary commands or code on unpatched systems.
The first vulnerability, tracked as CVE-2026-44277, is an improper access control issue in FortiAuthenticator.
“An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.” reads the advisory.
Below are the impacted versions:
| Version | Affected | Solution |
|---|---|---|
| FortiAuthenticator 8.0 | 8.0.2 | Upgrade to 8.0.3 or above |
| FortiAuthenticator 8.0 | 8.0.0 | Upgrade to 8.0.3 or above |
| FortiAuthenticator 6.6 | 6.6.0 through 6.6.8 | Upgrade to 6.6.9 or above |
| FortiAuthenticator 6.5 | 6.5.0 through 6.5.6 | Upgrade to 6.5.7 or above |
The vulnerability doesn’t affect FortiAuthenticator Cloud.
Fortinet experts discovered the flaw as part of an internal audit.
The second flaw addressed by the cybersecurity vendor is a missing authorization issue, tracked as CVE-2026-26083, in FortiSandbox. An attacker can trigger the flaw to achieve remote code execution on vulnerable systems.
“A missing authorization vulnerability [CWE-862] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.” reads the advisory.
Neither flaw has been exploited in in-the-wild attacks.
Adham El Karn from the Fortinet Product Security team discovered and reported the issue internally.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, FortiAuthenticator)
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。