InfoSecBulletin Cybersecurity for mankind
Fortinet patches 5 flaws on May 12, 2026 in its wireless access point controllers, network operating system, and enterprise management tools. One issue is a serious flaw that allows access without authorization in FortiSandbox.
Critical Flaw in FortiSandbox
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The critical flaw, found is CVE-2026-26083 (FG-IR-26-136), which is a missing permission issue that impacts FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
This serious security issue can be accessed through a GUI and does not need any login. This means a remote attacker could reach private functions or sensitive sandbox analysis data without any credentials.
Affected versions include FortiSandbox 5.0 and 4.4, FortiSandbox Cloud 24, 23, and 5.0, and FortiSandbox PaaS versions spanning 22.1 through 23.4. The unauthenticated attack surface makes this the highest-priority patch in the batch.
| CVE | Product | Severity | Vector | Auth Required |
|---|---|---|---|---|
| CVE-2026-26083 | FortiSandbox / Cloud / PaaS | Critical | GUI | No |
| CVE-2025-53680 | FortiAP, FortiAP-U, FortiAP-W2 | Medium | CLI | Yes |
| CVE-2025-53870 | FortiAP, FortiAP-W2 | Medium | CLI | Yes |
| CVE-2025-67604 | FortiAnalyzer, FortiManager | Medium | API | Yes |
| CVE-2025-53844 | FortiOS | Medium | CAPWAP | Yes |
Organizations using affected Fortinet products should fix CVE-2026-26083 right away because it is Critical and can be attacked without any login.
For medium-severity flaws, security teams should use available patches in their next maintenance time, limit CLI and API access to trusted admins only, and watch internal network traffic for unusual CAPWAP or API activity.
Fortinet’s PSIRT advisory page is the best place to find details about patch versions and workarounds.
Related news:
OpenAI Unveils “Daybreak” To Automates Vulnerability Detection and Fixing
Bangladeshi “RapidLogX” Helps Unmask Real Scammers with 20+ Data Points
BGD e-GOV CIRT offically colaborated with “Have I Been Pwned”
