Urgent Alert: Critical Remote Code Execution Vulnerabilities Found in FortiSandbox and FortiAuthenticator

Fortinet Addresses Critical Vulnerabilities in FortiSandbox and FortiAuthenticator

Fortinet, a leading cybersecurity company, has recently released security updates to fix two critical vulnerabilities in its FortiSandbox and FortiAuthenticator products. These vulnerabilities could potentially allow attackers to execute arbitrary code on systems that have not been patched.

The first vulnerability, identified as CVE-2026-44277, affects FortiAuthenticator Identity and Access Management (IAM) solution. Fortinet has released patches for this vulnerability in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3. According to Fortinet, this vulnerability could be exploited by an unauthenticated attacker to run unauthorized code or commands through manipulated requests.

It’s important to note that FortiAuthenticator Cloud, a cloud-based Identity and Access Management service provided by Fortinet, is not affected by this vulnerability.

Fortinet also addressed another critical vulnerability, CVE-2026-26083, in FortiSandbox. This vulnerability could be exploited to achieve remote code execution on vulnerable FortiSandbox systems, which are designed to protect against malicious activities and zero-day threats. Fortinet has released patches to address this vulnerability.

While there is no evidence of these vulnerabilities being actively exploited in the wild, Fortinet vulnerabilities are often targeted in ransomware and cyber-espionage attacks, especially as zero-day vulnerabilities.

For example, earlier this year, Fortinet fixed a critical vulnerability (CVE-2026-21643) in the FortiClient Enterprise Management Server (EMS) platform, which was later reported to be actively exploited. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive to secure FortiClient EMS instances against an actively exploited authentication bypass flaw (CVE-2026-35616) in April.

Overall, CISA has identified and cataloged 24 Fortinet vulnerabilities that have been actively exploited in recent years, with 13 of them being used in ransomware attacks.