FORTISANDBOX · CVE-2026-26248 · Infrastructure
NO FIX YET
Several FortiSandbox releases contain a cross-site scripting flaw in their web interface. An unauthenticated attacker can run script in a victim's browser session by tricking them into opening a crafted link.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running a FortiSandbox appliance, FortiSandbox Cloud or PaaS in the listed versions whose web UI is reachable by users. An attacker needs to trick a person (for example an admin) into opening a crafted link, so exposure matters most where the GUI is reachable from untrusted networks. Branch 5.2 is not listed as affected in the CVE record.
Not affected if version-outside-ranges
Who cares fortinet, fortisandbox, self-hosted, web-ui, xss
5.0.0-5.0.5, 4.4.0-4.4.8, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.55.0.6 and fix other FortiSandbox issues in the same ranges, so also check whether those are installed and look for the Fortinet PSIRT advisoryA improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
4.4.9No fix yet, per the sources.