CVE-2026-27316
Full vulnerability record from the local CVENow database.
Description
A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection.
Severity
LOW
CVSS score
2.7
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 16:16:37.863000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-27316",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T16:16:37.863",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection."
},
{
"lang": "es",
"value": "Una vulnerabilidad de credenciales insuficientemente protegidas en Fortinet FortiSandbox 5.0.0 a 5.0.5, FortiSandbox 4.4 en todas sus versiones, FortiSandbox PaaS 5.0.1 a 5.0.5 puede permitir a un administrador autenticado leer las credenciales del servidor LDAP a través de la inspección del lado del cliente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiSandbox",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "5.0.0",
"lessThanOrEqual": "5.0.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.4.0",
"lessThanOrEqual": "4.4.9",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Fortinet",
"product": "FortiSandbox PaaS",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.1:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "23.4.4374",
"status": "affected"
},
{
"version": "23.4.4350",
"status": "affected"
},
{
"version": "23.3.4329",
"status": "affected"
},
{
"version": "23.1.4245",
"status": "affected"
},
{
"version": "22.2.4151",
"status": "affected"
},
{
"version": "22.2.4134",
"status": "affected"
},
{
"version": "22.1.4113",
"status": "affected"
},
{
"version": "21.4.4072",
"status": "affected"
},
{
"version": "21.3.4055",
"status": "affected"
},
{
"version": "5.0.1",
"lessThanOrEqual": "5.0.5",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 2.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.2,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-14T16:29:34.942295Z",
"id": "CVE-2026-27316",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-522"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.0",
"versionEndExcluding": "5.0.6",
"matchCriteriaId": "69DCB6D2-21D3-4EE8-9A81-5DA8292EFB28"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisandbox_cloud:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E5E86B19-95E8-4107-85DC-EFE47225418C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisandbox_cloud:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAB696D-20A1-4C1A-8DD6-FDECD560AC9C"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-113",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}