InfoSecBulletin Cybersecurity for mankind
Fortinet patches 5 flaws on May 12, 2026 in its wireless access point controllers, network operating system, and enterprise management tools. One issue is a serious flaw that allows access without authorization in FortiSandbox.
Critical Flaw in FortiSandbox
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
The critical flaw, found is CVE-2026-26083 (FG-IR-26-136), which is a missing permission issue that impacts FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
This serious security issue can be accessed through a GUI and does not need any login. This means a remote attacker could reach private functions or sensitive sandbox analysis data without any credentials.
Affected versions include FortiSandbox 5.0 and 4.4, FortiSandbox Cloud 24, 23, and 5.0, and FortiSandbox PaaS versions spanning 22.1 through 23.4. The unauthenticated attack surface makes this the highest-priority patch in the batch.
| CVE | Product | Severity | Vector | Auth Required |
|---|---|---|---|---|
| CVE-2026-26083 | FortiSandbox / Cloud / PaaS | Critical | GUI | No |
| CVE-2025-53680 | FortiAP, FortiAP-U, FortiAP-W2 | Medium | CLI | Yes |
| CVE-2025-53870 | FortiAP, FortiAP-W2 | Medium | CLI | Yes |
| CVE-2025-67604 | FortiAnalyzer, FortiManager | Medium | API | Yes |
| CVE-2025-53844 | FortiOS | Medium | CAPWAP | Yes |
Organizations using affected Fortinet products should fix CVE-2026-26083 right away because it is Critical and can be attacked without any login.
For medium-severity flaws, security teams should use available patches in their next maintenance time, limit CLI and API access to trusted admins only, and watch internal network traffic for unusual CAPWAP or API activity.
Fortinet’s PSIRT advisory page is the best place to find details about patch versions and workarounds.
Related news:
OpenAI Unveils “Daybreak” To Automates Vulnerability Detection and Fixing
Bangladeshi “RapidLogX” Helps Unmask Real Scammers with 20+ Data Points
BGD e-GOV CIRT offically colaborated with “Have I Been Pwned”
