# Fortinet Critical Unauthenticated RCE — FortiAuthenticator CVE-2026-44277 & FortiSandbox CVE-2026-26083

> Fortinet PSIRT disclosed two CRITICAL unauthenticated remote code execution vulnerabilities on 2026-05-12 affecting FortiAuthenticator (CVE-2026-44277, FG-IR-26-128, CWE-284 Improper Access Control on API endpoints) and FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaS (CVE-2026-26083, FG-IR-26-136, CWE-862 Missing Authorization in the WEB UI). Both flaws score CVSSv3.1 9.8 (NVD) — network-reachable, no authentication, no user interaction — and allow remote attackers to execute unauthorized code or commands. Discovered internally by Fortinet Product Security; no public PoC at time of publication, but Fortinet edge/security appliances have a documented history of rapid post-disclosure weaponization (26 prior Fortinet entries on the CISA KEV catalog).

- **Published:** 2026-05-12T12:00:00Z
- **Last reviewed:** 2026-05-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0503
- **ID:** TL-2026-0503
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-44277, CVE-2026-26083

## Description

On 2026-05-12 Fortinet's Product Security Incident Response Team (PSIRT) published two synchronized advisories disclosing CRITICAL unauthenticated remote code execution vulnerabilities in two of its core identity and threat-analysis products: FortiAuthenticator (FG-IR-26-128 / CVE-2026-44277) and FortiSandbox plus its Cloud and PaaS variants (FG-IR-26-136 / CVE-2026-26083). Both vulnerabilities share the same CVSSv3.1 vector — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — yielding an NVD base score of 9.8 (Fortinet PSIRT lists 9.1 internally). The combination of network-reachable attack surface, no authentication, no user interaction, and high impact across confidentiality, integrity, and availability marks both as drop-everything patch priorities for any organization running affected versions.

CVE-2026-44277 is an Improper Access Control weakness (CWE-284) in FortiAuthenticator's API endpoint authorization logic. FortiAuthenticator is Fortinet's identity-management appliance: it handles RADIUS, LDAP proxy, certificate issuance, two-factor authentication tokens, FSSO collector, and SAML/OIDC federation for the Fortinet Security Fabric. Affected versions include 8.0.0 and 8.0.2, 6.6.0 through 6.6.8, and 6.5.0 through 6.5.6, fixed in 8.0.3, 6.6.9, and 6.5.7 respectively. FortiAuthenticator Cloud is explicitly not impacted. Because the product brokers authentication for downstream Fortinet appliances, a compromised FortiAuthenticator can mint or extract credentials, issue rogue certificates, manipulate FSSO mappings, and pivot into protected networks under valid-account cover — a classic identity-tier blast-radius scenario reminiscent of the 2024 FortiManager FortiJump (CVE-2024-47575) chain, except striking the directory and 2FA layer directly.

CVE-2026-26083 is a Missing Authorization weakness (CWE-862) in the FortiSandbox WEB UI. FortiSandbox is Fortinet's network sandbox / detonation chamber for suspicious files and URLs; it is deployed inline behind FortiGate, FortiMail, and FortiWeb to perform behavioural malware analysis. Affected on-prem versions are 5.0.0 through 5.0.1 and 4.4.0 through 4.4.8 (fixed in 5.0.2 and 4.4.9). FortiSandbox Cloud 24, Cloud 23, Cloud 5.0.2-5.0.5 are affected (fixed in Cloud 5.0.6). FortiSandbox PaaS is affected across releases 21.3, 21.4, 22.1, 22.2, 23.1, 23.3, 23.4, 5.0.0-5.0.1, and 4.4.5-4.4.8 (fixed in PaaS 5.0.2 and 4.4.9). Exploitation is via HTTP requests against the WEB UI: an unauthenticated attacker can invoke privileged actions that are missing authorization checks, leading to code execution in the appliance context. Post-exploit access to a FortiSandbox is highly valuable to an adversary because (a) it sees and stores adversary samples submitted across the Security Fabric, (b) it can be coerced into returning benign verdicts for attacker-controlled samples, blinding upstream FortiGate/FortiMail decisions, and (c) the appliance is trusted by adjacent devices for sample submission and verdict callbacks.

No public PoC, exploit chain, or in-the-wild exploitation has been reported as of the 2026-05-12 publication. Both vulnerabilities were discovered internally — CVE-2026-44277 by Fortinet's internal audit team, CVE-2026-26083 credited to Adham El karn of Fortinet Product Security. However, Fortinet edge and security-fabric appliances have a documented and aggressive weaponization curve: 26 Fortinet CVEs are listed in the CISA Known Exploited Vulnerabilities catalog, and recent classes including FortiOS authentication bypass (CVE-2022-40684), FortiGate SSL-VPN heap overflow (CVE-2022-42475), FortiOS path traversal (CVE-2022-41328), and the FortiJump FortiManager chain (CVE-2024-47575) all moved from advisory to active exploitation within days to weeks. The unauthenticated network-reachable nature of both 2026-05-12 advisories, combined with the high-value role of identity and malware-analysis appliances inside the kill chain, makes both strong candidates for short-fuse weaponization by both nation-state actors (historically Volt Typhoon, APT41, UNC3886, UNC5221, Storm-1567) and financially motivated ransomware affiliates (Akira, BlackCat/ALPHV, LockBit successors, Medusa, RansomHub) that have repeatedly used Fortinet zero-day and n-day to gain initial access.

Expected exploit chain progression once weaponized: (1) Internet-wide scanning for FortiAuthenticator and FortiSandbox management interfaces — Shodan and Censys consistently surface tens of thousands of internet-exposed FortiAuthenticator and FortiSandbox WEB UIs. (2) Unauthenticated HTTP/HTTPS request against the vulnerable API or WEB UI endpoint, bypassing the missing authorization check. (3) Code execution in the appliance context. For FortiAuthenticator, this typically yields the apache/web user or root depending on the vulnerable handler; for FortiSandbox, the WEB UI process runs with elevated privileges in the appliance. (4) Web-shell or implant drop into a writable directory under the web tree or persistence via cron / systemd unit. (5) For FortiAuthenticator: extraction of LDAP bind credentials, RADIUS shared secrets, SAML signing keys, and FortiToken seeds; manipulation of FSSO mappings to assert valid-account identities downstream. (6) For FortiSandbox: extraction of submitted samples (potentially including red-team tooling and unredacted documents), tampering with verdict callbacks to whitelist attacker payloads, and using the trusted FortiSandbox-to-FortiGate channel for lateral movement. (7) Establishment of C2 — historically Fortinet n-day exploit campaigns use a combination of in-appliance reverse shells, Cobalt Strike beacons, ShadowPad-family backdoors (state-aligned), or commodity Sliver / Brute Ratel implants for operator interaction.

Defensive priority: emergency patch both products, restrict management-plane exposure to dedicated admin VLANs / VPN, log and alert on any HTTP request to FortiAuthenticator /api/* or FortiSandbox WEB UI endpoints from non-management network ranges, and treat any FortiAuthenticator or FortiSandbox that was internet-exposed between 2026-05-12 disclosure and patch installation as potentially compromised pending forensic triage. Where patching is not immediately possible, Fortinet's standard hardening guidance applies: disable the WEB UI on FortiSandbox where management is performed via CLI; tightly firewall the FortiAuthenticator administration ports; rotate all FortiAuthenticator-managed secrets (RADIUS, LDAP, SAML signing keys, FortiToken seeds) after upgrade if exposure is suspected.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505.003 Server Software Component: Web Shell
- T1053.003 Scheduled Task/Job: Cron
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1556 Modify Authentication Process
- T1078 Valid Accounts
- T1555 Credentials from Password Stores
- T1552.001 Unsecured Credentials: Credentials In Files
- T1649 Steal or Forge Authentication Certificates
- T1111 Multi-Factor Authentication Interception
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [Fortinet PSIRT FG-IR-26-128 — FortiAuthenticator improper access control on API endpoints (CVE-2026-44277)](https://fortiguard.fortinet.com/psirt/FG-IR-26-128)
- [Fortinet PSIRT FG-IR-26-136 — FortiSandbox incorrect global authorization (CVE-2026-26083)](https://fortiguard.fortinet.com/psirt/FG-IR-26-136)
- [NVD CVE-2026-44277 — FortiAuthenticator Improper Access Control (CWE-284)](https://nvd.nist.gov/vuln/detail/CVE-2026-44277)
- [NVD CVE-2026-26083 — FortiSandbox Missing Authorization (CWE-862)](https://nvd.nist.gov/vuln/detail/CVE-2026-26083)
- [CWE-284 — Improper Access Control](https://cwe.mitre.org/data/definitions/284.html)
- [CWE-862 — Missing Authorization](https://cwe.mitre.org/data/definitions/862.html)
- [CISA Known Exploited Vulnerabilities Catalog — Fortinet entries](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [MITRE ATT&CK T1505.003 — Server Software Component: Web Shell](https://attack.mitre.org/techniques/T1505/003/)
- [Fortinet Security Fabric Hardening Guide](https://docs.fortinet.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0503