FortiSandbox Cloud vulnerabilities

7 known vulnerabilities in FortiSandbox Cloud from Fortinet. 7 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Input During Web Page Generation

  CVE-2026-26248Nov 10, 2026Fortinet

  A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSan

• 9.9 Critical severity

  FortiSandbox: Improper Access Control

  CVE-2026-26084Sep 8, 2026Fortinet

  A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access se

• 9.8 Critical severity

  Fortinet FortiSandbox OS Command Injection Exploited

  CVE-2026-25089Jun 9, 2026FortinetEPSS 76.1%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, Fo

• 9.8 Critical severity

  FortiSandbox: Missing Authorization

  CVE-2026-26083May 12, 2026Fortinet

  A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.0 through 5.0.1, FortiSandbox Cloud 4.4.5 through 4.4.8, FortiSandbox PaaS 23.4 all vers

• 7.2 High severity

  FortiSandbox Cloud: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-25836Mar 10, 2026FortinetEPSS 1.96%

  An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unautho

• 7.2 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-53679Dec 9, 2025FortinetEPSS 11.9%

  An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 a

• 8.8 High severity

  FortiSandbox: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-54026Mar 11, 2025Fortinet

  An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, Fo