SecBoard
Zurück zur CVE-Übersicht

CVE-2026-26084

CRITICAL(9.9)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.9 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.9

Technische Schwere

Beschreibung

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Die Schwachstelle betrifft unsachgemäße Zugriffskontrolle über manipulierte HTTP-Anfragen. Eine generische Verhaltenserkennung könnte ungewöhnliche HTTP-Anfragen an FortiSandbox-Systeme oder den Zugriff auf sensible Informationen nach solchen Anfragen überwachen. Da keine spezifischen Pfade oder Parameter genannt werden, ist eine präzise IOC-basierte Erkennung nicht möglich.

Sentinel/Defender KQL

let FortiSandboxIPs = dynamic(['<IP_OF_FORTISANDBOX_1>', '<IP_OF_FORTISANDBOX_2>']);
DeviceNetworkEvents
| where RemoteIP in (FortiSandboxIPs) or LocalIP in (FortiSandboxIPs)
| where InitiatingProcessFileName has_any ("curl", "wget", "python", "php", "powershell") or InitiatingProcessCommandLine has_any ("http:", "https:")
| where RemotePort == 80 or RemotePort == 443
| summarize RequestCount = count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| where RequestCount > 10 // Adjust threshold as needed for unusual activity
| project DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, RequestCount
// Further investigation needed for successful sensitive information access.

Splunk SPL

(dest=<IP_OF_FORTISANDBOX_1> OR dest=<IP_OF_FORTISANDBOX_2>) (port=80 OR port=443) (process=*curl* OR process=*wget* OR process=*python* OR process=*php* OR process=*powershell*) | stats count by host, dest, port, process, command | where count > 10

Sigma

title: FortiSandbox Improper Access Control Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential attempts to exploit improper access control in FortiSandbox via unusual HTTP requests.
author: SecBoard
date: 2026/01/01
logsource:
  category: network_connection
  product: fortisandbox
detection:
  selection:
    TargetIp|startswith:
      - '<IP_OF_FORTISANDBOX_1>'
      - '<IP_OF_FORTISANDBOX_2>'
    TargetPort:
      - 80
      - 443
    InitiatingProcessName|contains:
      - 'curl'
      - 'wget'
      - 'python'
      - 'php'
      - 'powershell'
  condition: selection
  timeframe: 5m
  level: medium
falsepositives:
  - Legitimate administrative scripts or tools.
tags:
  - attack.initial_access
  - cve.2026.26084

Elastic ES|QL

from network.connection
| where destination.ip in ('<IP_OF_FORTISANDBOX_1>', '<IP_OF_FORTISANDBOX_2>')
| where destination.port == 80 or destination.port == 443
| where process.name in ('curl', 'wget', 'python', 'php', 'powershell')
| summarize request_count = count() by host.name, destination.ip, destination.port, process.name, process.command_line
| where request_count > 10

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen