Fortinet Critical Unauthenticated RCE — FortiAuthenticator CVE-2026-44277 & FortiSandbox CVE-2026-26083

Fortinet Critical Unauthenticated RCE (TL-2026-0503), also tracked as FG-IR-26-128, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-05-12. It has no confirmed attribution, affects Fortinet FortiAuthenticator, references 2 CVEs (CVE-2026-44277, CVE-2026-26083), maps to 29 MITRE ATT&CK techniques (T1018, T1021, T1041), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-0503

Threat ID
TL-2026-0503
Also known as
FG-IR-26-128, FG-IR-26-136, Fortinet May 2026 PSIRT Tuesday
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-05-12
Last reviewed
2026-05-12
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, defense, financial, healthcare, energy, telecommunications, manufacturing, managed-security-service-providers, education, technology
Target regions
Global, North America, Europe, Asia-Pacific, Middle East
Detection rules
9
Indicators of compromise
24

Fortinet PSIRT disclosed two CRITICAL unauthenticated remote code execution vulnerabilities on 2026-05-12 affecting FortiAuthenticator (CVE-2026-44277, FG-IR-26-128, CWE-284 Improper Access Control on API endpoints) and FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaS (CVE-2026-26083, FG-IR-26-136, CWE-862 Missing Authorization in the WEB UI). Both flaws score CVSSv3.1 9.8 (NVD) — network-reachable, no authentication, no user interaction — and allow remote attackers to execute unauthorized code or commands. Discovered internally by Fortinet Product Security; no public PoC at time of publication, but Fortinet edge/security appliances have a documented history of rapid post-disclosure weaponization (26 prior Fortinet entries on the CISA KEV catalog).

How Fortinet Critical Unauthenticated RCE works

On 2026-05-12 Fortinet's Product Security Incident Response Team (PSIRT) published two synchronized advisories disclosing CRITICAL unauthenticated remote code execution vulnerabilities in two of its core identity and threat-analysis products: FortiAuthenticator (FG-IR-26-128 / CVE-2026-44277) and FortiSandbox plus its Cloud and PaaS variants (FG-IR-26-136 / CVE-2026-26083). Both vulnerabilities share the same CVSSv3.1 vector — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — yielding an NVD base score of 9.8 (Fortinet PSIRT lists 9.1 internally). The combination of network-reachable attack surface, no authentication, no user interaction, and high impact across confidentiality, integrity, and availability marks both as drop-everything patch priorities for any organization running affected versions.

CVE-2026-44277 is an Improper Access Control weakness (CWE-284) in FortiAuthenticator's API endpoint authorization logic. FortiAuthenticator is Fortinet's identity-management appliance: it handles RADIUS, LDAP proxy, certificate issuance, two-factor authentication tokens, FSSO collector, and SAML/OIDC federation for the Fortinet Security Fabric. Affected versions include 8.0.0 and 8.0.2, 6.6.0 through 6.6.8, and 6.5.0 through 6.5.6, fixed in 8.0.3, 6.6.9, and 6.5.7 respectively. FortiAuthenticator Cloud is explicitly not impacted. Because the product brokers authentication for downstream Fortinet appliances, a compromised FortiAuthenticator can mint or extract credentials, issue rogue certificates, manipulate FSSO mappings, and pivot into protected networks under valid-account cover — a classic identity-tier blast-radius scenario reminiscent of the 2024 FortiManager FortiJump (CVE-2024-47575) chain, except striking the directory and 2FA layer directly.

CVE-2026-26083 is a Missing Authorization weakness (CWE-862) in the FortiSandbox WEB UI. FortiSandbox is Fortinet's network sandbox / detonation chamber for suspicious files and URLs; it is deployed inline behind FortiGate, FortiMail, and FortiWeb to perform behavioural malware analysis. Affected on-prem versions are 5.0.0 through 5.0.1 and 4.4.0 through 4.4.8 (fixed in 5.0.2 and 4.4.9). FortiSandbox Cloud 24, Cloud 23, Cloud 5.0.2-5.0.5 are affected (fixed in Cloud 5.0.6). FortiSandbox PaaS is affected across releases 21.3, 21.4, 22.1, 22.2, 23.1, 23.3, 23.4, 5.0.0-5.0.1, and 4.4.5-4.4.8 (fixed in PaaS 5.0.2 and 4.4.9). Exploitation is via HTTP requests against the WEB UI: an unauthenticated attacker can invoke privileged actions that are missing authorization checks, leading to code execution in the appliance context. Post-exploit access to a FortiSandbox is highly valuable to an adversary because (a) it sees and stores adversary samples submitted across the Security Fabric, (b) it can be coerced into returning benign verdicts for attacker-controlled samples, blinding upstream FortiGate/FortiMail decisions, and (c) the appliance is trusted by adjacent devices for sample submission and verdict callbacks.

No public PoC, exploit chain, or in-the-wild exploitation has been reported as of the 2026-05-12 publication. Both vulnerabilities were discovered internally — CVE-2026-44277 by Fortinet's internal audit team, CVE-2026-26083 credited to Adham El karn of Fortinet Product Security. However, Fortinet edge and security-fabric appliances have a documented and aggressive weaponization curve: 26 Fortinet CVEs are listed in the CISA Known Exploited Vulnerabilities catalog, and recent classes including FortiOS authentication bypass (CVE-2022-40684), FortiGate SSL-VPN heap overflow (CVE-2022-42475), FortiOS path traversal (CVE-2022-41328), and the FortiJump FortiManager chain (CVE-2024-47575) all moved from advisory to active exploitation within days to weeks. The unauthenticated network-reachable nature of both 2026-05-12 advisories, combined with the high-value role of identity and malware-analysis appliances inside the kill chain, makes both strong candidates for short-fuse weaponization by both nation-state actors (historically Volt Typhoon, APT41, UNC3886, UNC5221, Storm-1567) and financially motivated ransomware affiliates (Akira, BlackCat/ALPHV, LockBit successors, Medusa, RansomHub) that have repeatedly used Fortinet zero-day and n-day to gain initial access.

Expected exploit chain progression once weaponized: (1) Internet-wide scanning for FortiAuthenticator and FortiSandbox management interfaces — Shodan and Censys consistently surface tens of thousands of internet-exposed FortiAuthenticator and FortiSandbox WEB UIs. (2) Unauthenticated HTTP/HTTPS request against the vulnerable API or WEB UI endpoint, bypassing the missing authorization check. (3) Code execution in the appliance context. For FortiAuthenticator, this typically yields the apache/web user or root depending on the vulnerable handler; for FortiSandbox, the WEB UI process runs with elevated privileges in the appliance. (4) Web-shell or implant drop into a writable directory under the web tree or persistence via cron / systemd unit. (5) For FortiAuthenticator: extraction of LDAP bind credentials, RADIUS shared secrets, SAML signing keys, and FortiToken seeds; manipulation of FSSO mappings to assert valid-account identities downstream. (6) For FortiSandbox: extraction of submitted samples (potentially including red-team tooling and unredacted documents), tampering with verdict callbacks to whitelist attacker payloads, and using the trusted FortiSandbox-to-FortiGate channel for lateral movement. (7) Establishment of C2 — historically Fortinet n-day exploit campaigns use a combination of in-appliance reverse shells, Cobalt Strike beacons, ShadowPad-family backdoors (state-aligned), or commodity Sliver / Brute Ratel implants for operator interaction.

Defensive priority: emergency patch both products, restrict management-plane exposure to dedicated admin VLANs / VPN, log and alert on any HTTP request to FortiAuthenticator /api/* or FortiSandbox WEB UI endpoints from non-management network ranges, and treat any FortiAuthenticator or FortiSandbox that was internet-exposed between 2026-05-12 disclosure and patch installation as potentially compromised pending forensic triage. Where patching is not immediately possible, Fortinet's standard hardening guidance applies: disable the WEB UI on FortiSandbox where management is performed via CLI; tightly firewall the FortiAuthenticator administration ports; rotate all FortiAuthenticator-managed secrets (RADIUS, LDAP, SAML signing keys, FortiToken seeds) after upgrade if exposure is suspected.

MITRE ATT&CK techniques used in TL-2026-0503

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery

Lateral Movement

T1021 Remote Services; T1550 Use Alternate Authentication Material

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Scheduled Task/Job: Cron; T1098 Account Manipulation; T1505.003 Server Software Component: Web Shell

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Defense Evasion

T1078 Valid Accounts

Credential Access

T1111 Multi-Factor Authentication Interception; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores; T1649 Steal or Forge Authentication Certificates

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

defense-impairment

T1556 Modify Authentication Process; T1685 Disable or Modify Tools

Impact

T1565 Data Manipulation

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Fortinet Critical Unauthenticated RCE

  • Fortinet — FortiAuthenticator
    Vulnerable versions: 8.0.0; 8.0.2; 6.6.0 through 6.6.8; 6.5.0 through 6.5.6
    Fixed in: 8.0.3 or above; 6.6.9 or above; 6.5.7 or above
  • Fortinet — FortiSandbox
    Vulnerable versions: FortiSandbox 5.0.0 through 5.0.1; FortiSandbox 4.4.0 through 4.4.8
    Fixed in: FortiSandbox 5.0.2 or above; FortiSandbox 4.4.9 or above
  • Fortinet — FortiSandbox Cloud
    Vulnerable versions: FortiSandbox Cloud 24 all versions; FortiSandbox Cloud 23 all versions; FortiSandbox Cloud 5.0.2 through 5.0.5
    Fixed in: FortiSandbox Cloud 5.0.6 or above
  • Fortinet — FortiSandbox PaaS
    Vulnerable versions: FortiSandbox PaaS 23.4 all versions; FortiSandbox PaaS 23.3 all versions; FortiSandbox PaaS 23.1 all versions; FortiSandbox PaaS 22.2 all versions; FortiSandbox PaaS 22.1 all versions; FortiSandbox PaaS 21.4 all versions; FortiSandbox PaaS 21.3 all versions; FortiSandbox PaaS 5.0.0 through 5.0.1; FortiSandbox PaaS 4.4.5 through 4.4.8
    Fixed in: FortiSandbox PaaS 5.0.2 or above; FortiSandbox PaaS 4.4.9 or above

Remediation for Fortinet Critical Unauthenticated RCE

Patches

  • FortiAuthenticator 8.0.3 or above (fixes 8.0.0 and 8.0.2)
  • FortiAuthenticator 6.6.9 or above (fixes 6.6.0 through 6.6.8)
  • FortiAuthenticator 6.5.7 or above (fixes 6.5.0 through 6.5.6)
  • FortiSandbox 5.0.2 or above (fixes 5.0.0 through 5.0.1)
  • FortiSandbox 4.4.9 or above (fixes 4.4.0 through 4.4.8)
  • FortiSandbox Cloud 5.0.6 or above (fixes Cloud 23, Cloud 24, Cloud 5.0.2-5.0.5)
  • FortiSandbox PaaS 5.0.2 or above (fixes PaaS 5.0.0-5.0.1 and prior PaaS releases 21.3-23.4)
  • FortiSandbox PaaS 4.4.9 or above (fixes PaaS 4.4.5 through 4.4.8)

Immediate actions

  • FortiAuthenticator: upgrade to 8.0.3 or above, 6.6.9 or above, or 6.5.7 or above per FG-IR-26-128.
  • FortiSandbox on-prem: upgrade to 5.0.2 or above, or 4.4.9 or above per FG-IR-26-136.
  • FortiSandbox Cloud: upgrade to Cloud 5.0.6 or above (Fortinet has begun rolling tenant upgrades).
  • FortiSandbox PaaS: upgrade to PaaS 5.0.2 or above, or PaaS 4.4.9 or above (Fortinet has begun rolling tenant upgrades).
  • Block external/Internet access to FortiAuthenticator API endpoints and FortiSandbox WEB UI; restrict to dedicated admin VLANs or jump hosts only.
  • If patching is delayed, deploy WAF or upstream firewall rules to deny unauthenticated HTTP requests to /api/ and /admin/ paths on affected appliances.
  • Rotate all FortiAuthenticator-managed secrets after upgrade if Internet exposure existed: RADIUS shared secrets, LDAP bind credentials, SAML/OIDC signing keys, FortiToken seeds, certificate-issuing keys.

Workarounds

  • FortiAuthenticator: restrict management API access to specific source IPs via trustedhost configuration; block API endpoints at upstream firewall.
  • FortiSandbox: disable the WEB UI listener where management is performed via CLI/SSH only; restrict HTTPS access via local-in policy.
  • FortiAuthenticator Cloud is NOT impacted by CVE-2026-44277 — migration to Cloud is a valid medium-term option.

Longer-term hardening

  • Treat FortiAuthenticator and FortiSandbox as Tier-0 identity / inspection infrastructure; isolate on management VLANs unreachable from user and DMZ networks.
  • Implement strict zero-trust segmentation around the Fortinet Security Fabric management plane; require step-up auth and PAM-mediated access to all Fortinet admin UIs.
  • Continuous attack surface monitoring (Shodan / Censys / internal scan) for any internet-exposed Fortinet management interfaces and alert on appearance.
  • Subscribe to and triage every Fortinet PSIRT advisory same-day; Fortinet appliances have a documented track of rapid weaponization.
  • Establish forensic baselines (file integrity, scheduled task inventory, web tree hashes) for FortiAuthenticator and FortiSandbox to accelerate triage of any future compromise.

CVEs associated with Fortinet Critical Unauthenticated RCE

CVE-2026-44277, CVE-2026-26083

Weaknesses (CWE) in Fortinet Critical Unauthenticated RCE

CWE-284, CWE-862

Timeline of Fortinet Critical Unauthenticated RCE

  • Status set ACTIVE; exploitability THEORETICAL pending public PoC or telemetry; both CVEs flagged KEV candidates for next 30-day window.
  • 26 Fortinet entries already on CISA KEV catalog. Historical baseline: prior Fortinet edge / security-fabric advisories of similar severity (CVE-2022-40684, CVE-2022-42475, CVE-2024-47575) moved from advisory to in-the-wild exploitation within days to weeks.
  • Threadlinqs Intelligence opens TL-2026-0503 for tracking. Internet exposure analysis: tens of thousands of FortiAuthenticator and FortiSandbox WEB UIs surfaced via Shodan and Censys queries; high attack-surface concentration in EU and APAC enterprise networks.
  • Both vulnerabilities credited to internal Fortinet teams — CVE-2026-44277 to Fortinet internal audit; CVE-2026-26083 to Adham El karn of Fortinet Product Security. No third-party reporters.
  • Fortinet releases fixed builds: FortiAuthenticator 8.0.3, 6.6.9, 6.5.7; FortiSandbox 5.0.2, 4.4.9; FortiSandbox Cloud 5.0.6 (tenant upgrade rolling); FortiSandbox PaaS 5.0.2, 4.4.9 (tenant upgrade rolling).
  • NVD publishes CVE-2026-44277 and CVE-2026-26083 with CVSSv3.1 base score 9.8 (Fortinet PSIRT internal score 9.1). Both flagged 'Undergoing Analysis'.
  • Fortinet PSIRT publishes FG-IR-26-128 (CVE-2026-44277, FortiAuthenticator) and FG-IR-26-136 (CVE-2026-26083, FortiSandbox) — synchronized release of two CRITICAL unauthenticated RCE advisories.
  • As of 2026-05-29, Fortinet's CVE-2026-44277 (FortiAuthenticator) and CVE-2026-26083 (FortiSandbox) remain patched same-day, internally-discovered with no confirmed in-the-wild exploitation and not on CISA KEV. They stay a live concern: a public detection scanner exists, exposure is high, and Fortinet n-days historically weaponize within days-to-weeks, leaving unpatched Tier-0 assets at risk.

Sources cited for Fortinet Critical Unauthenticated RCE

Threats related to Fortinet Critical Unauthenticated RCE

Detection coverage for TL-2026-0503

As of 2026-05-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0503 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats