Security News

Cybersecurity news aggregator

CRITICAL Vulnerabilities SC Media

Fortinet addresses critical vulnerabilities in FortiSandbox and FortiAuthenticator

Fortinet has patched two critical vulnerabilities (CVE-2026-44277 and CVE-2026-26083, both CVSS 9.8) allowing unauthenticated remote code execution via crafted HTTP requests. CVE-2026-44277 affects FortiAuthenticator, while CVE-2026-26083 impacts FortiSandbox systems, including cloud and PaaS versions. Patches are available in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3, though specific fixed versions for FortiSandbox are not provided in the source.
Read Full Article →

Vulnerability Management Fortinet addresses critical vulnerabilities in FortiSandbox and FortiAuthenticator May 13, 2026 Share By SC Staff (Credit: Rafael Henrique – stock.adobe.com) Fortinet has released security updates to address two critical vulnerabilities in its FortiSandbox and FortiAuthenticator products, which could allow attackers to execute arbitrary code on unpatched systems, according to a recent report by Bleeping Computer. The first vulnerability, CVE-2026-44277, affects FortiAuthenticator's Identity and Access Management solution and was patched in versions 6.5.7, 6.6.9, and 8.0.3. It allows unauthenticated attackers to execute unauthorized code or commands through crafted requests. The second vulnerability, CVE-2026-26083, impacts FortiSandbox systems, including cloud and PaaS versions, and permits unauthenticated attackers to execute unauthorized code or commands via HTTP requests. While Fortinet has not confirmed these flaws are actively exploited, Fortinet products are frequently targeted in ransomware and cyber-espionage attacks. The U.S. Cybersecurity and Infrastructure Security Agency has added 24 Fortinet vulnerabilities to its catalog of actively exploited flaws in recent years, with 13 being used in ransomware attacks. Source: Bleeping Computer SC Staff Related Vulnerability Management Patch Tuesday: No zero days among 137 Microsoft CVEs, 4 Word RCEs Laura French May 12, 2026 The May 2026 Microsoft security update included no zero days for the first time since June 2024. Exposure management Fighting fire with fire: Defending against Mythos-powered cyberattacks Paul Wagenseil May 12, 2026 How AI-powered exposure management reduces the opportunities AI-powered attackers depend on. Vulnerability Management Linux maintainer proposes runtime killswitch for vulnerabilities SC Staff May 12, 2026 Linux kernel co-maintainer Sasha Levin has proposed a runtime killswitch mechanism, accessible via securityfs, to temporarily disable vulnerable kernel functions. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bug Buffer Overflow Disassembly You can skip this ad in 5 seconds

Share this article