CVE-2026-59835
A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VM
Severity
High 7.7
CVSS 3.1
Exploited
Not listed
EPSS
0.004
33.6th percentile
Discovered by
Third party
Vendor advisory field
Published
Jul 14, 2026
Assigned by fortinet
Description
A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.
Weakness: CWE-668
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSandbox | Threat Detection & Sandbox | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiSandbox
Credit
Fortinet is pleased to thank the team from INPS for reporting this vulnerability under responsible disclosure.
Vendor remediation
Upgrade to FortiSandbox version 5.0.3 or above Upgrade to FortiSandbox version 4.4.9 or above