FortiSandbox vulnerabilities

27 known vulnerabilities in FortiSandbox from Fortinet. 27 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Input During Web Page Generation

  CVE-2026-26248Nov 10, 2026Fortinet

  A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSan

• 9.8 Critical severity

  FortiSandbox: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-107656Oct 26, 2026Fortinet

  An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions,

• 7.2 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in a Command

  CVE-2026-84387Sep 8, 2026FortinetEPSS 1.56%

  An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions may al

• 9.9 Critical severity

  FortiSandbox: Improper Access Control

  CVE-2026-26084Sep 8, 2026Fortinet

  A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access se

• 8.6 High severity

  FortiSandbox: Exposure of Resource to Wrong Sphere

  CVE-2026-59835Jul 14, 2026Fortinet

  A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.

• 9.8 Critical severity

  Fortinet FortiSandbox OS Command Injection Exploited

  CVE-2026-25089Jun 9, 2026FortinetEPSS 76.1%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, Fo

• 9.8 Critical severity

  FortiSandbox: Missing Authorization

  CVE-2026-26083May 12, 2026Fortinet

  A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.0 through 5.0.1, FortiSandbox Cloud 4.4.5 through 4.4.8, FortiSandbox PaaS 23.4 all vers

• 9.8 Critical severity

  FortiSandbox: Path Traversal: '../filedir'

  CVE-2026-39813Apr 14, 2026FortinetEPSS 44%

  A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.

• 9.8 Critical severity

  Fortinet FortiSandbox OS Command Injection Exploited

  CVE-2026-39808Apr 14, 2026FortinetEPSS 93.2%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

• 9.6 Critical severity

  FortiSandbox: Improper Neutralization of Input During Web Page Generation

  CVE-2025-52436Feb 10, 2026FortinetEPSS 7.47%

  An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all ver

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-53949Dec 9, 2025FortinetEPSS 16.8%

  An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 a

• 7.2 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-53679Dec 9, 2025FortinetEPSS 11.9%

  An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 a

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-54026Mar 11, 2025Fortinet

  An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, Fo

• 7.2 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-54018Mar 11, 2025FortinetEPSS 10%

  Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests.

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-52961Mar 11, 2025Fortinet

  An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2.1 through 4.2.7, FortiSandbox 4.0.0 through 4.0.5, FortiSandbox 3.2 all

• 8.8 High severity

  FortiSandbox: Client-Side Enforcement of Server-Side Security

  CVE-2024-52960Mar 11, 2025Fortinet

  A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via craf

• 7.8 High severity

  FortiSandbox: Incorrect Authorization

  CVE-2024-45328Mar 11, 2025Fortinet

  An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu.

• 9.0 Critical severity

  FortiSandbox: Improper Neutralization of Input During Web Page Generation

  CVE-2024-27781Feb 11, 2025FortinetEPSS 28.2%

  An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-27778Jan 14, 2025Fortinet

  An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSand

• 8.8 High severity

  FortiSandbox: Client-Side Enforcement of Server-Side Security

  CVE-2024-31491May 14, 2024Fortinet

  A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests.

• 8.1 High severity

  FortiSandbox: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-23671Apr 9, 2024FortinetEPSS 1.16%

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or comm

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-21756Apr 9, 2024FortinetEPSS 2.18%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-21755Apr 9, 2024FortinetEPSS 2.48%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized

• 7.5 High severity

  FortiSandbox: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2023-41682Oct 13, 2023FortinetEPSS 1.08%

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, For

• 8.8 High severity

  FortiDeceptor: Improper Privilege Management

  CVE-2022-27487Apr 11, 2023Fortinet

  A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API

• 7.5 High severity

  FortiSandbox: Use of Password Hash With Insufficient Computational Effort

  CVE-2022-26115Feb 16, 2023Fortinet

  A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.

• 7.5 High severity

  FortiSandbox: Improper Restriction of Excessive Authentication Attempts

  CVE-2022-30305Dec 6, 2022Fortinet

  An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1