InfoSecBulletin Cybersecurity for mankind
Fortinet patches 5 flaws on May 12, 2026 in its wireless access point controllers, network operating system, and enterprise management tools. One issue is a serious flaw that allows access without authorization in FortiSandbox.
Critical Flaw in FortiSandbox
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
The critical flaw, found is CVE-2026-26083 (FG-IR-26-136), which is a missing permission issue that impacts FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
This serious security issue can be accessed through a GUI and does not need any login. This means a remote attacker could reach private functions or sensitive sandbox analysis data without any credentials.
Affected versions include FortiSandbox 5.0 and 4.4, FortiSandbox Cloud 24, 23, and 5.0, and FortiSandbox PaaS versions spanning 22.1 through 23.4. The unauthenticated attack surface makes this the highest-priority patch in the batch.
| CVE | Product | Severity | Vector | Auth Required |
|---|---|---|---|---|
| CVE-2026-26083 | FortiSandbox / Cloud / PaaS | Critical | GUI | No |
| CVE-2025-53680 | FortiAP, FortiAP-U, FortiAP-W2 | Medium | CLI | Yes |
| CVE-2025-53870 | FortiAP, FortiAP-W2 | Medium | CLI | Yes |
| CVE-2025-67604 | FortiAnalyzer, FortiManager | Medium | API | Yes |
| CVE-2025-53844 | FortiOS | Medium | CAPWAP | Yes |
Organizations using affected Fortinet products should fix CVE-2026-26083 right away because it is Critical and can be attacked without any login.
For medium-severity flaws, security teams should use available patches in their next maintenance time, limit CLI and API access to trusted admins only, and watch internal network traffic for unusual CAPWAP or API activity.
Fortinet’s PSIRT advisory page is the best place to find details about patch versions and workarounds.
Related news:
OpenAI Unveils “Daybreak” To Automates Vulnerability Detection and Fixing
Bangladeshi “RapidLogX” Helps Unmask Real Scammers with 20+ Data Points
BGD e-GOV CIRT offically colaborated with “Have I Been Pwned”
