Latest critical severity vulnerabilities for "fortinet fortisandbox"

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

1 / 3

Source: NVD

First published (updated )

CVE-2026-25089

Fortinet FortiSandboxSecond-Order OS Command Injection via JSON Input on start vnc feature

Risk 84

Severity

9.1

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

First published (updated )

Advisory

FG-IR-26-141

Fortinet FortiSandboxIncorrect global authorization

Risk 84

Severity

9.1

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

A missing authorization vulnerability [CWE-862] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

First published (updated )

Advisory

FG-IR-26-136

Fortinet FortiSandboxIncorrect global authorization

Risk 91

Severity

9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

1 / 2

Source: FortiGuard

First published (updated )

CVE-2026-26083

Fortinet FortiSandboxOS Command Injection through API endpoint

Risk 84

Severity

9.1

Command Injection, OS Command Injection

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

An Improper Neutralization of Special Elements used in an OS Command ('OS command injection') vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

First published (updated )

Advisory

FG-IR-26-100

Fortinet FortiSandboxOS Command Injection through API endpoint

Risk 99

Severity

9.8

Exploited

Command Injection, OS Command Injection

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

1 / 3

Source: NVD

First published (updated )

CVE-2026-39808

Fortinet FortiSandboxUnauthenticated Authentication bypass and Privilege escalation in FortiSandbox

Risk 84

Severity

9.1

Path Traversal

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

A Path Traversal vulnerability [CWE-24] in FortiSandbox JRPC API may allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests.

First published (updated )

Advisory

FG-IR-26-112

Fortinet FortiSandboxUnauthenticated Authentication bypass and Privilege escalation in FortiSandbox

Risk 91

Severity

9.8

Path Traversal

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

A Path Traversal vulnerability [CWE-24] in FortiSandbox JRPC API may allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests.

1 / 2

Source: FortiGuard

First published (updated )

CVE-2026-39813

Fortinet FortiSandboxXSS via back button

Risk 80

Severity

9.6

XSS

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox may allow an unauthenticated attacker to execute commands via crafted requests. FortiSandbox PaaS versions 4.4.8 and 5.0.5 contains the fix for this vulnerability.

1 / 2

Source: FortiGuard

Remedy

Upgrade to FortiSandbox version 5.0.2 or above Upgrade to FortiSandbox version 4.4.8 or above

First published (updated )

CVE-2025-52436

Fortinet FortiSandboxMultiple Reflected and Stored Cross-Site Scripting

Risk 74

Severity

XSS

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

1 / 2

Source: MITRE

Remedy

Upgrade to FortiSandbox version 4.4.5 or above Upgrade to FortiSandbox version 4.2.7 or above Upgrade to FortiSandbox version 4.0.5 or above Fortinet remediated this issue in FortiSandbox Cloud version 24.1 and hence customers do not need to perform any action.

First published (updated )

CVE-2024-27781

Trending

Versions

Fortinet FortiSandboxSecond-Order OS Command Injection via JSON Input on start vnc feature

Fortinet FortiSandboxSecond-Order OS Command Injection via JSON Input on start vnc feature

Fortinet FortiSandboxIncorrect global authorization

Fortinet FortiSandboxIncorrect global authorization

Fortinet FortiSandboxOS Command Injection through API endpoint

Don't miss critical vulnerabilities

Fortinet FortiSandboxOS Command Injection through API endpoint

Fortinet FortiSandboxUnauthenticated Authentication bypass and Privilege escalation in FortiSandbox

Fortinet FortiSandboxUnauthenticated Authentication bypass and Privilege escalation in FortiSandbox

Fortinet FortiSandboxXSS via back button

Remedy

Fortinet FortiSandboxMultiple Reflected and Stored Cross-Site Scripting

Remedy

Don't miss critical vulnerabilities

Company

Resources

Contact