Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator

Fortinet released patches for two critical vulnerabilities: CVE-2026-44277 (improper access control in FortiAuthenticator) and CVE-2026-26083 (missing authorization in FortiSandbox), both of which may allow unauthenticated remote code execution; FortiAuthenticator Cloud is not affected and Fortinet advises updating to the fixed versions, while noting the company’s products have been frequently targeted in past ransomware and espionage activity though these specific flaws are not reported as exploited in the wild.