Advisories · Technology

Fortinet FortiSandbox.

Every CVE that names Fortinet FortiSandbox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-107656 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Authentication bypass in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox PaaS
- Authentication bypass
Not analysed yet 26 Oct 2026
CVE-2026-106172 CVE record

CVSS 4.9 Medium

Hard-coded cryptographic key in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox Cloud
- Hard-coded credentials
Not analysed yet 13 Oct 2026
CVE-2026-106170 CVE record

CVSS 4.8 Medium

Fortinet FortiSandbox: An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox…
- Fortinet FortiSandbox
- CWE-248
Not analysed yet 13 Oct 2026
CVE-2026-26084 CVE record

CVSS 8.9 High

Improper access control in Fortinet FortiSandbox PaaS and others
- Fortinet FortiSandbox PaaS
- Fortinet FortiSandbox
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-84387 CVE record

CVSS 6.7 Medium

Command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 8 Sept 2026
CVE-2026-59835 CVE record

CVSS 7.7 High

Resource exposure in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Information disclosure
Not analysed yet 14 Jul 2026
CVE-2026-25089 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

OS command injection in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox Cloud
- Command injection
Not analysed yet 9 Jun 2026
CVE-2026-26083 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authorization in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox PaaS
- Broken access control
Not analysed yet 12 May 2026
CVE-2026-39813 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Path traversal in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox Cloud
- Path traversal
Not analysed yet 14 Apr 2026
CVE-2025-61886 CVE record

CVSS 4.9 Medium

Cross-site scripting in Fortinet FortiSandbox PaaS and others
- Fortinet FortiSandbox PaaS
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 14 Apr 2026
CVE-2026-39812 CVE record

CVSS 4.3 Medium

Cross-site scripting in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox PaaS
- Cross-site scripting (XSS)
Not analysed yet 14 Apr 2026
CVE-2026-25691 CVE record

CVSS 6.2 Medium

Path traversal in Fortinet FortiSandbox PaaS and others
- Fortinet FortiSandbox PaaS
- Fortinet FortiSandbox Cloud
- Path traversal
Not analysed yet 14 Apr 2026
CVE-2026-27316 CVE record

CVSS 2.5 Low

Insufficiently protected credentials in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox PaaS
- Hard-coded credentials
Not analysed yet 14 Apr 2026
CVE-2026-39808 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

OS command injection in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox PaaS
- Command injection
Not analysed yet 14 Apr 2026
CVE-2025-53608 CVE record

CVSS 4.6 Medium

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 10 Mar 2026
CVE-2025-52436 CVE record

CVSS 7.9 High

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 10 Feb 2026
CVE-2025-67685 CVE record

CVSS 3.4 Low

Server-side request forgery in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Server-side request forgery (SSRF)
Not analysed yet 13 Jan 2026
CVE-2025-53679 CVE record

CVSS 6.9 Medium

OS command injection in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox Cloud
- Command injection
Not analysed yet 9 Dec 2025
CVE-2025-54353 CVE record

CVSS 5.3 Medium

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 9 Dec 2025
CVE-2025-53949 CVE record

CVSS 7.0 HighCritical · CVSS 7+ and EPSS

OS command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 9 Dec 2025
CVE-2025-46215 CVE record

CVSS 5.0 Medium

Fortinet FortiSandbox: An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet…
- Fortinet FortiSandbox
- CWE-653
Not analysed yet 18 Nov 2025
CVE-2024-27779 CVE record

CVSS 6.3 Medium

Insufficient session expiration in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiIsolator
- Authentication bypass
Not analysed yet 18 Jul 2025
CVE-2021-26105 CVE record

CVSS 6.4 Medium

Fortinet FortiSandbox: A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of…
- Fortinet FortiSandbox
- CWE-358
Not analysed yet 24 Mar 2025
CVE-2024-54027 CVE record

CVSS 7.8 High

Hard-coded cryptographic key in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Hard-coded credentials
Not analysed yet 17 Mar 2025
CVE-2024-54026 CVE record

CVSS 4.1 Medium

SQL injection in Fortinet FortiSandbox and others
- Fortinet FortiSandbox
- Fortinet FortiSandbox Cloud
- SQL injection
Not analysed yet 11 Mar 2025
CVE-2024-54018 CVE record

CVSS 6.5 Medium

OS command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 11 Mar 2025
CVE-2024-52960 CVE record

CVSS 4.2 Medium

Fortinet FortiSandbox: A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet…
- Fortinet FortiSandbox
- CWE-602
Not analysed yet 11 Mar 2025
CVE-2024-52961 CVE record

CVSS 8.6 High

OS command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 11 Mar 2025
CVE-2024-45328 CVE record

CVSS 7.1 High

Incorrect authorization in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Broken access control
Not analysed yet 11 Mar 2025
CVE-2024-27781 CVE record

CVSS 6.9 Medium

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2025
CVE-2024-27778 CVE record

CVSS 8.3 High

OS command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 14 Jan 2025
CVE-2024-31490 CVE record

CVSS 4.2 Medium

Information disclosure in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Information disclosure
Not analysed yet 10 Sept 2024
CVE-2024-31491 CVE record

CVSS 8.6 High

Fortinet FortiSandbox: A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox…
- Fortinet FortiSandbox
- CWE-602
Not analysed yet 14 May 2024
CVE-2024-21755 CVE record

CVSS 8.6 High

OS command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 9 Apr 2024
CVE-2024-21756 CVE record

CVSS 8.6 High

OS command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 9 Apr 2024
CVE-2023-47540 CVE record

CVSS 6.5 Medium

OS command injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Command injection
Not analysed yet 9 Apr 2024
CVE-2024-31487 CVE record

CVSS 5.8 Medium

Path traversal in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Path traversal
Not analysed yet 9 Apr 2024
CVE-2024-23671 CVE record

CVSS 7.9 High

Path traversal in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Path traversal
Not analysed yet 9 Apr 2024
CVE-2023-47541 CVE record

CVSS 6.5 Medium

Path traversal in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Path traversal
Not analysed yet 9 Apr 2024
CVE-2023-41844 CVE record

CVSS 3.4 Low

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 13 Dec 2023
CVE-2023-45587 CVE record

CVSS 3.4 Low

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 13 Dec 2023
CVE-2023-41836 CVE record

CVSS 3.4 Low

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2023
CVE-2023-41843 CVE record

CVSS 7.3 High

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2023
CVE-2023-41680 CVE record

CVSS 7.3 High

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2023
CVE-2023-41681 CVE record

CVSS 7.3 High

Cross-site scripting in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2023
CVE-2023-41682 CVE record

CVSS 7.9 High

Path traversal in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Path traversal
Not analysed yet 13 Oct 2023
CVE-2022-22305 CVE record

CVSS 5.4 Medium

Improper certificate validation in Fortinet FortiAnalyzer and others
- Fortinet FortiAnalyzer
- Fortinet FortiSandbox
- Weak cryptography or TLS
Not analysed yet 1 Sept 2023
CVE-2022-27485 CVE record

CVSS 6.2 Medium

SQL injection in Fortinet FortiSandbox
- Fortinet FortiSandbox
- SQL injection
Not analysed yet 11 Apr 2023
CVE-2022-27487 CVE record

CVSS 8.3 High

Improper privilege management in Fortinet FortiDeceptor and others
- Fortinet FortiDeceptor
- Fortinet FortiSandbox
- Privilege escalation
Not analysed yet 11 Apr 2023
CVE-2022-26115 CVE record

CVSS 5.4 Medium

Weak password hashing in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Weak cryptography or TLS
Not analysed yet 16 Feb 2023
CVE-2022-30305 CVE record

CVSS 3.6 Low

Fortinet FortiSandbox: An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2…
- Fortinet FortiSandbox
- Fortinet FortiDeceptor
- CWE-778
Not analysed yet 6 Dec 2022
CVE-2020-29013 CVE record

CVSS 5.4 Medium

An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests.
- Fortinet FortiSandbox
Not analysed yet 6 Apr 2022
CVE-2021-32591 CVE record

CVSS 5.3 Medium

A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0…
- Fortinet FortiSandbox
Not analysed yet 8 Dec 2021
CVE-2020-29012 CVE record

CVSS 5.6 Medium

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users con…
- Fortinet FortiSandbox
Not analysed yet 8 Sept 2021
CVE-2020-15939 CVE record

CVSS 4.3 Medium

An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration…
- Fortinet FortiSandbox
Not analysed yet 6 Sept 2021
CVE-2021-24014 CVE record

CVSS 5.4 Medium

Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an XSS attack via speci…
- Fortinet FortiSandbox
Not analysed yet 4 Aug 2021
CVE-2021-26096 CVE record

CVSS 6.4 Medium

Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content by means of specifica…
- Fortinet FortiSandbox
Not analysed yet 4 Aug 2021
CVE-2021-26097 CVE record

CVSS 8.8 High

An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6 may allow an authenticated attacke…
- Fortinet FortiSandbox
Not analysed yet 4 Aug 2021
CVE-2020-29011 CVE record

CVSS 8.8 High

Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated attacker to execut…
- Fortinet FortiSandbox
Not analysed yet 4 Aug 2021
CVE-2021-24010 CVE record

CVSS 8.1 High

Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated user to obtain unauthorized access…
- Fortinet FortiSandbox
Not analysed yet 4 Aug 2021