CVE-2026-26248
EUVD-2026-12282510.11.2026, 20:19
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| fortinet | fortisandbox | 5.0.0 ≤ 𝑥 ≤ 5.0.5 | CNA |
| fortinet | fortisandbox | 4.4.0 ≤ 𝑥 ≤ 4.4.8 | CNA |
| fortinet | fortisandbox | 4.2.1 ≤ 𝑥 ≤ 4.2.8 | CNA |
| fortinet | fortisandbox | 5.0.4 ≤ 𝑥 ≤ 5.0.5 | CNA |
| fortinet | fortisandbox_paas | 5.0.4 ≤ 𝑥 ≤ 5.0.5 | CNA |