Fortinet patches CVE-2026-26084 in FortiSandbox

Update September 19, 2026: Fortinet released advisory FG-IR-26-166 for CVE-2026-26084, an access-control flaw in FortiSandbox that can expose information. CISA included it in its weekly summary for the week of September 7, and Fortinet said there is no evidence of active exploitation.

Fortinet, Commvault and Microsoft were all in focus in the CISC bulletin published on September 8, 2026. The roundup was meant to guide mitigation and risk prioritization in Brazil. It included Fortinet cloud services, Commvault Cloud, and Microsoft’s September patch cycle, which delivered about 970 fixes and several issues tied to identity and cloud services.

What did the Brazilian bulletin include?

The CISC bulletin gathered vulnerabilities from international vendors affecting both cloud services and hybrid environments. In Fortinet’s case, the international advisories aligned to the same time window point to FortiSandbox Cloud 5.0 and FortiSandbox PaaS 5.0, in versions 5.0.4 through 5.0.5. For Commvault Cloud, the Canadian advisory detailed affected version ranges in the 11.36, 11.40, 11.44, and 11.46 branches, earlier than specific builds.

What changed in Fortinet’s case?

Fortinet published advisory FG-IR-26-166 on September 8, 2026, about CVE-2026-26084 in the FortiSandbox web interface. The flaw has a CVSS score of 8.9 and is classified as a CWE-284 access-control issue. It affects both on-premises installations and the FortiSandbox Cloud and FortiSandbox PaaS services.

CVE-2026-26084 allows a remote, unauthenticated attacker to send specially crafted HTTP requests to the shared FortiSandbox GUI and access sensitive information, including configurations and logs. The described impact is information exposure, not code execution.

Affected versions include FortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5, as well as FortiSandbox Cloud 5.0.4 through 5.0.5 and FortiSandbox PaaS 5.0.4 through 5.0.5. The fix arrives in 4.4.9 and 5.0.6, while the 5.2 branch and certain cloud builds are not affected.

CISA added CVE-2026-26084 to its weekly vulnerability summary for the week of September 7, 2026. The U.S. agency kept the description of sensitive information access through manipulated HTTP requests and the 8.9 severity score.

Fortinet said its internal Product Security team discovered the flaw and credited Adham El Karn. The company also said that, at the time of the advisory, it had no evidence of real-world exploitation.

Why does cloud remain the focus?

Because the flaws are not limited to local appliances, they also affect services used by organizations in cloud and multi-tenant setups. According to the Canadian Centre for Cyber Security, Fortinet’s vulnerabilities broaden the risk surface into cloud components. In Microsoft’s case, technical analysis of the September 8 cycle said several of the highest-priority vulnerabilities were tied to cloud identity and associated services before public disclosure.

What does Microsoft’s September cycle show?

It shows an unusually large patch window, with around 970 vulnerabilities fixed on September 8, 2026, according to the research sources cited in the material. That set included critical flaws in identity and cloud services affecting global tenants. Independent analysis described the same cycle as a two-track release, with the most sensitive risk concentrated in cloud components.

How urgent is the prioritization?

The same set of vulnerabilities from the September 8 and 9, 2026 window fed known-exploited vulnerability catalogs and mandatory patching orders for federal agencies in other countries. The cited material mentions critical flaws in artifact platforms, remote access, and routers, all common components in hybrid and cloud infrastructure. At the same time, private security firms in Brazil described the cycle as marked by active attacks against Microsoft, VMware and SAP Commerce Cloud, including a remote code execution flaw in the latter service.

Independent technical bulletins and weekly cybersecurity newsletters placed the FortiSandbox vulnerability, including Cloud and PaaS, among the high-impact flaws of the second week of September 2026. The same coverage listed it alongside a Microsoft zero-day and critical bugs in other products, reinforcing its priority in global cloud patch management programs.

Third-party technical content and blogs also described an additional cluster of critical FortiSandbox vulnerabilities during September 2026, including CVE-2026-39808, CVE-2026-25089 and CVE-2026-26083, linked to remote code execution and confirmed active exploitation. That front increased operational risk for environments combining on-premises FortiSandbox with deployments integrated into public clouds.

What about the rest of September’s cycle?

Recommendations from Asian players such as AhnLab for the September 2026 patch cycle listed multiple Microsoft update waves, from September 3 through September 17, and stressed the need to fold Patch Tuesday and out-of-cycle releases into unified security management for Azure and Microsoft 365 services in corporate cloud environments. Later technical coverage also pointed to critical patches in Azure Database for PostgreSQL and other managed cloud services, with references to national CERT advisories such as Paraguay’s.