---
id: "CVE-2026-26248"
page: "https://infrastack.ai/live/CVE-2026-26248"
kind: "vulnerability"
aliases: ["CVE-2026-26248"]
title: "Fortinet FortiSandbox: unauthenticated cross-site scripting via crafted requests"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiSandbox", "fixed": [], "affected": "5.0.0 - 5.0.5; 4.4.0 - 4.4.8", "ecosystem": "vendor"}, {"name": "FortiSandbox Cloud", "fixed": [], "affected": "5.0.4 - 5.0.5", "ecosystem": "vendor"}, {"name": "FortiSandbox PaaS", "fixed": [], "affected": "5.0.4 - 5.0.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortinet", "fortisandbox", "infrastructure", "self-hosted", "web-ui", "xss"]
not_affected_if: ["version-outside-ranges"]
published_at: "2026-11-10T20:19:11+00:00"
first_seen_at: "2026-11-10T20:46:04+00:00"
updated_at: "2026-11-10T20:54:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26248", "first_seen_at": "2026-11-10T20:46:04+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:54:24+00:00"}]
exploit_sources: []
---

# Fortinet FortiSandbox: unauthenticated cross-site scripting via crafted requests

Link for people: https://infrastack.ai/live/CVE-2026-26248 (this .md is for agents)

Several FortiSandbox releases contain a cross-site scripting flaw in their web interface. An unauthenticated attacker can run script in a victim's browser session by tricking them into opening a crafted link.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiSandbox affected 5.0.0 - 5.0.5; 4.4.0 - 4.4.8 fixed no fixed version listed
- vendor:FortiSandbox Cloud affected 5.0.4 - 5.0.5 fixed no fixed version listed
- vendor:FortiSandbox PaaS affected 5.0.4 - 5.0.5 fixed no fixed version listed

## How to check

Check the FortiSandbox version (GUI dashboard or CLI get status) against: FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5. Fixed versions are not yet confirmed for this CVE: 5.0.6 and 4.4.9 fix other FortiSandbox issues in the same ranges, so also check whether those are installed and look for the Fortinet PSIRT advisory.

## Timeline

- 2026-11-10T20:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-26248
- 2026-11-10T20:54:24+00:00 analyst — No Fortinet PSIRT page for this CVE found yet (published today; NVD/CVE record only). Affected ranges from CVE record. Same ranges in sibling FortiSandbox advisories (FG-IR-26-166, -141) are fixed in 5.0.6 / 4.4.9, but not confirmed for this CVE. Nothing verified. Re-check PSIRT for the FG-IR id.

## From the sources

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_