Fortinet's July 2026 security advisory addresses seven vulnerabilities across its core security fabric products, including a high-severity VNC exposure flaw (CVE-2026-59835) that leaves unauthenticated remote access to FortiSandbox management interfaces. This advisory is distinct from the two FortiSandbox CVEs (CVE-2026-25089, CVE-2026-39808) added to CISA KEV on July 17 — it covers a broader set of flaws affecting FortiOS, FortiProxy, FortiPAM, FortiSASE, and FortiSandbox.
Advisory Overview
| Advisory ID | CVE | Severity | Products | Component | Attack Vector | Type |
|---|---|---|---|---|---|---|
| FG-IR-26-154 | CVE-2025-43892 | Medium | FortiOS, FortiProxy, FortiSASE | CLI (authd, wad) | Authenticated, External | Buffer over-read |
| FG-IR-26-152 | CVE-2025-62675 | Low | FortiOS, FortiProxy | Web Filter warning page | Unauthenticated, External | HTTP response splitting / header injection |
| FG-IR-26-153 | CVE-2025-62826 | Low | FortiOS, FortiProxy | Captive portal auth form | Unauthenticated, External | HTTP response splitting / header injection |
| FG-IR-26-151 | CVE-2026-59839 | Medium | FortiOS, FortiPAM, FortiProxy | CLI | Authenticated, External | Path traversal (root filesystem delete) |
| FG-IR-26-150 | CVE-2026-23573 | Medium | FortiOS, FortiPAM, FortiProxy | SSL-VPN | Unauthenticated, External | Reflected XSS |
| FG-IR-26-148 | CVE-2026-59837 | Medium | FortiOS, FortiProxy, FortiPAM | GUI (Log Report) | Authenticated, External | Stack-based buffer overflow |
| FG-IR-26-145 | CVE-2026-59835 | High | FortiSandbox | VNC | Unauthenticated, External | VNC exposed on all interfaces |
All advisories published: July 14, 2026 by Fortinet PSIRT.
Deep Dive: The Critical Flaw — CVE-2026-59835 (VNC Exposure)
What It Is
FortiSandbox appliances (versions 5.2.5, 5.0.5, 4.4.4 and earlier) expose the VNC (Virtual Network Computing) service on all network interfaces by default, without authentication. This allows any network-reachable attacker to connect to the VNC port (typically TCP 5900) and gain full graphical console access to the appliance's management interface.
Why It's Critical
- No authentication required — VNC server accepts connections without credentials
- All interfaces — Not limited to management interface; exposed on data ports too
- Full console access — Attacker sees exactly what a local admin sees: dashboard, configuration, logs, sandbox analysis results
- Persistence — VNC access survives reboots; can be used to maintain foothold
- Lateral movement — FortiSandbox often sits in sensitive network segments (DMZ, inspection zones) with access to file shares, mail servers, endpoint submissions
Affected FortiSandbox Versions
| Version Branch | Affected | Fixed In |
|---|---|---|
| 5.2.x | 5.2.5 and earlier | 5.2.6 |
| 5.0.x | 5.0.5 and earlier | 5.0.6 |
| 4.4.x | 4.4.4 and earlier | 4.4.5 |
Check version: get system status via CLI or System → Dashboard in GUI.
Exploitation Scenario
Other Notable Vulnerabilities
CVE-2026-59839: Authenticated Path Traversal (Root FS Delete)
Products: FortiOS, FortiPAM, FortiProxy
Vector: CLI command with crafted path parameter
Impact: Authenticated admin (or compromised admin creds) can delete arbitrary files from root filesystem (/etc/passwd, /bin/bash, firmware images).
Mitigation: Restrict CLI access to trusted admins; monitor for execute commands with ../ sequences.
CVE-2026-23573: SSL-VPN Reflected XSS
Products: FortiOS, FortiPAM, FortiProxy
Vector: Malicious URL parameter in SSL-VPN login portal
Impact: Steal VPN session cookies, credentials, or redirect to phishing. Requires user click.
Mitigation: Update firmware; enable SSL-VPN realm restrictions; user awareness.
CVE-2026-59837: Stack Buffer Overflow in Log Report GUI
Products: FortiOS, FortiProxy, FortiPAM
Vector: Authenticated GUI → Log & Report → crafted report parameters
Impact: DoS (crash report daemon) or potential RCE (stack overflow). Requires valid admin session.
Mitigation: Limit GUI access; update firmware.
CVE-2025-43892: Authenticated Buffer Over-read in authd/wad
Products: FortiOS, FortiProxy, FortiSASE
Vector: CLI/API with malformed authentication request
Impact: Information disclosure (heap memory leak) — may expose session tokens, pointers.
Mitigation: Update; restrict management access.
CVE-2025-62675 / CVE-2025-62826: HTTP Response Splitting (Low)
Products: FortiOS, FortiProxy
Vector: Web Filter warning page / Captive portal — inject CRLF in headers
Impact: Cache poisoning, header injection, possible session fixation. Low severity but wide attack surface.
Mitigation: Update; these are "hygiene" fixes.
Patching & Upgrade Guidance
Step 1: Inventory All Fortinet Assets
Step 2: Apply Fixed Versions
| Product | Fixed Version | Download Location |
|---|---|---|
| FortiOS / FortiGate | 7.4.4, 7.2.10, 7.0.15 | support.fortinet.com |
| FortiProxy | 7.4.4, 7.2.10 | support.fortinet.com |
| FortiPAM | 1.2.5 | FortiCloud / support.fortinet.com |
| FortiSASE | Automatic (cloud) | N/A — verify in portal |
| FortiSandbox | 5.2.6, 5.0.6, 4.4.5 | support.fortinet.com |
Use Fortinet Upgrade Path Tool to validate upgrade path before applying.
Step 3: Post-Patch Hardening (Critical for FortiSandbox)
Even after patching CVE-2026-59835, apply defense-in-depth:
Step 4: Verify Patch Application
- Check
get system statusfor version/build - Run vulnerability scan (Nessus, OpenVAS, FortiScanner)
- Review FortiGuard vulnerability feed for new signatures
Detection & Monitoring
Network IDS/IPS Signatures (Suricata)
FortiAnalyzer / SIEM Correlation Rules
- VNC connections to FortiSandbox from non-management subnets → Alert
- CLI commands containing
../or..\→ Alert - SSL-VPN login failures followed by successful login from new IP → Alert (XSS credential theft)
- Log Report daemon crashes (process
reportd) → Alert (buffer overflow attempt)
Log Sources to Enable
- FortiGate/FortiProxy:
eventlog,webfilter,ssl-vpn,cli-audit - FortiSandbox:
system,vnc,admin-login - FortiPAM:
audit,session,auth
Risk Scoring & Prioritization
| CVE | CVSS | Exploitability | Urgency | Action |
|---|---|---|---|---|
| CVE-2026-59835 | 9.0 (High) | Trivial (no auth) | IMMEDIATE | Patch + isolate VNC |
| CVE-2026-59839 | 6.5 (Medium) | Requires auth | 72 hours | Patch + restrict CLI |
| CVE-2026-23573 | 6.1 (Medium) | User interaction | 7 days | Patch + SSL-VPN hardening |
| CVE-2026-59837 | 6.5 (Medium) | Requires auth | 7 days | Patch + GUI restriction |
| CVE-2025-43892 | 5.9 (Medium) | Requires auth | 14 days | Patch |
| CVE-2025-62675/62826 | 3.7/3.7 (Low) | Unauth, complex | 30 days | Patch (hygiene) |
Frequently Asked Questions
Q: Is this related to the CISA KEV FortiSandbox CVEs (CVE-2026-25089, CVE-2026-39808)?
A: No. Those are different vulnerabilities (command injection in sandbox analysis engine) added to CISA KEV on July 17, 2026. This advisory covers seven separate CVEs including the VNC exposure (CVE-2026-59835). You must patch both sets.
Q: Does FortiSASE (cloud) require customer action?
A: FortiSASE is managed by Fortinet; patches apply automatically. Verify in FortiSASE portal → System → Version shows 7.4.4+.
Q: Can I mitigate CVE-2026-59835 without patching immediately?
A: Yes — block TCP 5900 at network perimeter for all FortiSandbox IPs, restrict management interface ACLs, and disable VNC via CLI (set admin-vnc disable). But patching is the only complete fix.
Q: Are there public exploits?
A: As of July 17, 2026, no public PoC exploits for these specific CVEs. However, VNC unauthenticated access is trivially exploitable with standard tools (vncviewer, nmap --script vnc-info). Assume weaponization is imminent.
Q: How do I know if I've been compromised?
A: Check:
- FortiSandbox VNC logs (
/var/log/vnc.log) for unknown source IPs - CLI audit logs for
executecommands with path traversal - SSL-VPN logs for anomalous login patterns
- Unexpected admin account creation or config changes
Q: What about FortiAnalyzer, FortiManager, FortiClient?
A: This advisory does not cover those products. Check Fortinet PSIRT advisory list for product-specific bulletins.
Key Takeaways
- CVE-2026-59835 (VNC exposure) is the crown jewel — unauthenticated, full console access to sandbox appliance. Patch FortiSandbox today.
- Seven CVEs across five products — inventory your Fortinet estate; don't miss FortiPAM or FortiSASE.
- Two Low-severity HTTP splitting bugs — easy to dismiss, but they affect every SSL-VPN/captive portal user. Patch for hygiene.
- Path traversal in CLI (CVE-2026-59839) — a reminder to restrict and audit privileged CLI access.
- This is separate from the CISA KEV FortiSandbox CVEs — you have two patch cycles to complete this week.
Conclusion
Fortinet's July 2026 advisory is a reminder that security appliances themselves are high-value targets. The VNC exposure in FortiSandbox (CVE-2026-59835) is a particularly dangerous configuration oversight — a management service listening on all interfaces without authentication violates basic hardening principles. Organizations running Fortinet's security fabric should treat this as a Critical priority patch cycle, complete inventory and patching within 24 hours for FortiSandbox, 72 hours for FortiOS/FortiProxy/FortiPAM, and validate that cloud-managed FortiSASE has auto-updated.
Sources:
- Fortinet PSIRT Advisories FG-IR-26-145 through FG-IR-26-154
- FortiSandbox 5.2.6 Release Notes
- FortiOS 7.4.4 Release Notes
- GBHackers: Fortinet Patches 7 Security Flaws
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.