Insufficiently protected credentials in FortiSandbox - CVE-2026-27316
Published: April 14, 2026
Vulnerability identifier: #VU125998
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-27316
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to gain access to sensitive information.
The vulnerability exists due to insufficiently protected credentials in LDAP configuration web page. An authenticated administrator can read LDAP server credentials via client-side inspection.
Affected software
FortiSandbox
How to mitigate CVE-2026-27316
Install update from vendor's website.
FortiSandbox - update to 5.0.6