{"id":"CVE-2026-26248","kind":"vulnerability","aliases":["CVE-2026-26248"],"related":[],"title":"Fortinet FortiSandbox: unauthenticated cross-site scripting via crafted requests","description":"A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.","summary":"Several FortiSandbox releases contain a cross-site scripting flaw in their web interface. An unauthenticated attacker can run script in a victim's browser session by tricking them into opening a crafted link.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiSandbox","fixed":[],"affected":"5.0.0 - 5.0.5; 4.4.0 - 4.4.8","ecosystem":"vendor"},{"name":"FortiSandbox Cloud","fixed":[],"affected":"5.0.4 - 5.0.5","ecosystem":"vendor"},{"name":"FortiSandbox PaaS","fixed":[],"affected":"5.0.4 - 5.0.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortinet","fortisandbox","infrastructure","self-hosted","web-ui","xss"],"not_affected_if":["version-outside-ranges"],"how_to_check":"Check the FortiSandbox version (GUI dashboard or CLI get status) against: FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5. Fixed versions are not yet confirmed for this CVE: 5.0.6 and 4.4.9 fix other FortiSandbox issues in the same ranges, so also check whether those are installed and look for the Fortinet PSIRT advisory.","fix":null,"status":"open","published_at":"2026-11-10T20:19:11+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","triaged_at":"2026-11-10T20:47:25+00:00","updated_at":"2026-11-10T20:54:24+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:47:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiSandbox: unauthenticated cross-site scripting via crafted requests","impact":"medium","summary":"Several FortiSandbox releases contain a cross-site scripting flaw in their web interface. An unauthenticated attacker can run script in a victim's browser session by tricking them into opening a crafted link.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortisandbox","fortinet","self-hosted","web-ui"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Script runs in an administrator's browser session on the sandbox","analyst_note":"Confirm fixed versions for each FortiSandbox branch from the Fortinet PSIRT advisory; NVD text alone states no fix.","how_to_check":"- Check the FortiSandbox version in the admin interface against the affected ranges: 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, Cloud 5.0.4 through 5.0.5, PaaS 5.0.4 through 5.0.5.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-ranges"],"who_is_affected":"Organizations running FortiSandbox appliances, cloud or PaaS within the listed version ranges. The attack needs a victim with access to the FortiSandbox web interface to click a crafted link, so exposure depends on who can reach the admin interface.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4620,"output_tokens":558,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed versions for each FortiSandbox branch from the Fortinet PSIRT advisory; NVD text alone states no fix.","search":"'-2026':12A,15A '-26248':13A,16A '4.4.0':87C '4.4.8':89C '5.0.0':83C '5.0.4':92C,97C '5.0.5':85C,94C,99C 'allow':101C 'attack':48B,104C,109C 'browser':56B 'cloud':19A,91C 'contain':35B 'craft':9A,64B,114C 'cross':5A,38B,76C 'cross-sit':4A,37B,75C 'cve':11A,14A 'engin':112C 'flaw':41B 'fortinet':1A,22B,81C 'fortisandbox':2A,17A,18A,20A,23B,33B,82C,86C,90C,95C 'generat':74C 'host':27B 'http':115C 'improp':67C 'infrastructur':24B 'input':70C 'interfac':45B 'link':65B 'may':100C 'neutral':68C 'open':62B 'paa':96C 'paas':21A 'page':73C 'perform':106C 'releas':34B 'request':10A,116C 'run':50B 'script':7A,40B,51B,78C 'self':26B 'self-host':25B 'session':57B 'sever':32B 'site':6A,39B,77C 'social':111C 'trick':59B 'ui':30B 'unauthent':3A,47B,103C 'via':8A,110C 'victim':54B 'vulner':79C 'web':29B,44B,72C 'web-ui':28B 'xss':31B,108C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a FortiSandbox appliance, FortiSandbox Cloud or PaaS in the listed versions whose web UI is reachable by users. An attacker needs to trick a person (for example an admin) into opening a crafted link, so exposure matters most where the GUI is reachable from untrusted networks. Branch 5.2 is not listed as affected in the CVE record.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cloud","fortisandbox","fortisandboxcloud","fortisandboxpaas","paas"],"ptokens":["cloud","fortisandbox","paas"],"labels":["fortinet","fortisandbox","high","infrastructure","selfhosted","webui","xss"],"campaign_type":null,"search_a":"'-2026':12A,15A '-26248':13A,16A 'cloud':19A 'craft':9A 'cross':5A 'cross-sit':4A 'cve':11A,14A 'fortinet':1A 'fortisandbox':2A,17A,18A,20A 'paas':21A 'request':10A 'script':7A 'site':6A 'unauthent':3A 'via':8A","search_b":"'attack':48B 'browser':56B 'contain':35B 'craft':64B 'cross':38B 'cross-sit':37B 'flaw':41B 'fortinet':22B 'fortisandbox':23B,33B 'host':27B 'infrastructur':24B 'interfac':45B 'link':65B 'open':62B 'releas':34B 'run':50B 'script':40B,51B 'self':26B 'self-host':25B 'session':57B 'sever':32B 'site':39B 'trick':59B 'ui':30B 'unauthent':47B 'victim':54B 'web':29B,44B 'web-ui':28B 'xss':31B","search_c":"'4.4.0':87C '4.4.8':89C '5.0.0':83C '5.0.4':92C,97C '5.0.5':85C,94C,99C 'allow':101C 'attack':104C,109C 'cloud':91C 'craft':114C 'cross':76C 'cross-sit':75C 'engin':112C 'fortinet':81C 'fortisandbox':82C,86C,90C,95C 'generat':74C 'http':115C 'improp':67C 'input':70C 'may':100C 'neutral':68C 'paa':96C 'page':73C 'perform':106C 'request':116C 'script':78C 'site':77C 'social':111C 'unauthent':103C 'via':110C 'vulner':79C 'web':72C 'xss':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-26248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26248","severity":null,"published_at":"2026-11-10T20:19:11+00:00","modified_at":"2026-11-10T20:19:11+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-26248:2723","url":null,"severity":null,"published_at":"2026-11-10T20:54:24+00:00","modified_at":"2026-11-10T20:54:24+00:00","first_seen_at":"2026-11-10T20:54:24+00:00","fetched_at":"2026-11-10T20:54:24+00:00","note":"No Fortinet PSIRT page for this CVE found yet (published today; NVD/CVE record only). Affected ranges from CVE record. Same ranges in sibling FortiSandbox advisories (FG-IR-26-166, -141) are fixed in 5.0.6 / 4.4.9, but not confirmed for this CVE. Nothing verified. Re-check PSIRT for the FG-IR id."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}