FortiSandbox Vulnerability Exposes Scanning VM VNC Servers to Remote Attackers

Fortinet has patched a high-severity FortiSandbox vulnerability that allows an unauthenticated remote attacker to access VNC servers attached to virtual machines performing malware scans.

The vulnerability, tracked as CVE-2026-59835, affects FortiSandbox 5.0.0 through 5.0.2 and versions 4.4.3 through 4.4.8. FortiSandbox 5.2 and FortiSandbox PaaS deployments are not affected.

Fortinet disclosed the vulnerability on July 14, 2026, in security advisory FG-IR-26-145. The company said it had not identified active exploitation when it published the advisory.

CVE-2026-59835 exposes scanning VM VNC services

FortiSandbox uses isolated virtual machines to open and analyze suspicious files. This process helps organizations observe malware behavior without running the files directly on production systems.

VNC provides remote access to a virtual machine’s screen and interface. CVE-2026-59835 improperly exposes the VNC servers used by FortiSandbox scanning VMs to network requests from unauthenticated attackers.

An attacker does not need an account, existing access to the appliance, or interaction from an administrator. The vulnerability has low attack complexity and can be exploited over a network.

Property	Details
CVE	CVE-2026-59835
Weakness	CWE-668: Exposure of Resource to Wrong Sphere
Attack vector	Network
Privileges required	None
User interaction	None
Attack complexity	Low
Fortinet PSIRT score	7.7 High
Fortinet CNA score shown by NVD	8.6 High
Known exploitation	None reported

Fortinet and NVD display different CVSS scores

Fortinet’s PSIRT advisory lists a CVSS 3.1 score of 7.7. However, the National Vulnerability Database record displays a Fortinet CNA score of 8.6.

The NVD page shows the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. This vector indicates a potentially high effect on confidentiality, with lower effects on integrity and availability.

NVD had not published its own independent score at the time of review. Despite the numerical difference, both Fortinet sources classify CVE-2026-59835 as a high-severity vulnerability.

What attackers could access

Successful exploitation gives an attacker access to the VNC server of a virtual machine performing a scan. Fortinet officially lists information disclosure as the primary impact.

The exposed VNC session could reveal information displayed inside the analysis environment. Depending on how the affected VNC service handles input, access may also create opportunities to interfere with the scanning VM, although Fortinet’s public description does not detail the full level of interaction available.

This access could weaken trust in malware-analysis results. It may also expose information about submitted files, analysis activity, or the configuration of the scanning environment.

Affected FortiSandbox versions and fixes

Fortinet has released corrected versions for both affected FortiSandbox branches. Administrators should confirm their exact installed release before scheduling the upgrade.

FortiSandbox branch	Affected versions	Required action
5.2	Not affected	No action required for this CVE
5.0	5.0.0 through 5.0.2	Upgrade to 5.0.3 or later
4.4	4.4.3 through 4.4.8	Upgrade to 4.4.9 or later
FortiSandbox PaaS	Not affected	No action required for this CVE

The Fortinet security advisory also identifies the FSA-500G and FSA-1500G hardware models as affected. Organizations using these appliances should check the installed FortiSandbox version rather than relying only on the hardware model.

FortiSandbox PaaS customers do not need to install an update for CVE-2026-59835. The advisory applies to affected on-premises FortiSandbox installations.

Why exposed VNC access matters

Security teams use FortiSandbox to handle files that may contain ransomware, information stealers, remote-access trojans, and other dangerous code. The product runs these files in controlled virtual machines and records their behavior.

An attacker who can view a scanning VM may gain information about the sample under analysis or how the sandbox evaluates it. Access to the interface could also provide useful intelligence for developing malware that recognizes or evades the analysis environment.

The CVE-2026-59835 record confirms that the vulnerable VNC servers belong to virtual machines performing scans. It does not indicate that the flaw directly grants administrative access to the FortiSandbox appliance itself.

How organizations should respond

Organizations should install the corrected FortiSandbox release as soon as their maintenance process allows. Internet-accessible systems and appliances reachable from large or untrusted internal networks need the highest priority.

Security teams should also check whether network controls expose VNC or FortiSandbox management services beyond the systems that require access.

Recommended actions include:

• Upgrade FortiSandbox 5.0.0 through 5.0.2 to version 5.0.3 or later.
• Upgrade FortiSandbox 4.4.3 through 4.4.8 to version 4.4.9 or later.
• Confirm the software versions running on FSA-500G and FSA-1500G appliances.
• Restrict access to FortiSandbox interfaces with firewalls and management networks.
• Block external access to unnecessary VNC ports and services.
• Review network logs for unexpected connections to VNC services associated with scanning VMs.
• Inspect recent malware-analysis activity for unexplained interruptions or unusual behavior.

No active exploitation reported

Fortinet marked CVE-2026-59835 as not known to be exploited when it released the advisory. That status can change as attackers examine public vulnerability details and compare vulnerable and corrected versions.

Fortinet credited the security team from INPS with finding and reporting the vulnerability. The disclosure followed Fortinet’s coordinated vulnerability process.

The lack of reported exploitation should not delay patching. CVE-2026-59835 requires no authentication or user interaction, making exposed vulnerable appliances attractive targets once technical exploitation details become available.

FAQ