UpHeron
All vulnerabilities

Servers and applications

CVE-2026-26248

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.

Severity
High 7.9
Published
10 Nov 2026
Last changed
10 Nov 2026
Added to UpHeron
10 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Fortinet FortiSandboxServers and applications · cna:fortinet|fortisandbox
  • From 4.2.1 up to 4.2.8
  • From 4.4.0 up to 4.4.8
  • From 5.0.0 up to 5.0.5
Fortinet FortiSandboxServers and applications · cpe:a:fortinet:fortisandbox
  • From 4.2.1 up to 4.2.8
  • From 4.4.0 up to 4.4.8
  • From 5.0.0 up to 5.0.5

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-26248