Vulnerability record/PUBLISHED/Published Nov 10, 2026 20:10:39 UTC

CVE-2026-26248

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.

Base score7.9/ 10

SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredNonePR

User interactionRequiredUI

ScopeUnchangedS

Confidentiality impactHighC

Integrity impactHighI

Availability impactHighA

Exploit maturityProof of conceptE

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityfortinet

Last updatedNov 11, 2026 03:55:44 UTC

PublishedNov 10, 2026 20:10:39 UTC

ReservedFeb 12, 2026 12:07:02 UTC