Fortisandbox (Fortinet) - vulnerabilities (CVEs)

65 CVEs, 3 in the last 30 days, 93 known versions, newest CVE from 2026-10-26. Vendor: Fortinet.

CVEs of Fortisandbox

• CVE-2026-107656 - CVSS 9.8 (critical), 2026-10-26: An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9,…
• CVE-2026-106172 - CVSS 5.3 (medium), 2026-10-13: A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all…
• CVE-2026-106170 - CVSS 4.9 (medium), 2026-10-13: An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4…
• CVE-2026-26084 - CVSS 9.9 (critical), 2026-09-08: A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through…
• CVE-2026-84387 - CVSS 7.2 (high), 2026-09-08: A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through…
• CVE-2026-59835 - CVSS 8.6 (high), 2026-07-14: A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an…
• CVE-2026-25089 - CVSS 9.8 (critical), 2026-06-09: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,…
• CVE-2026-26083 - CVSS 9.8 (critical), 2026-05-12: A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5,…
• CVE-2026-39813 - CVSS 9.8 (critical), 2026-04-14: A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation…
• CVE-2026-39812 - CVSS 4.8 (medium), 2026-04-14: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,…
• CVE-2026-39808 - CVSS 9.8 (critical), 2026-04-14: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may…
• CVE-2026-27316 - CVSS 2.7 (low), 2026-04-14: A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1…
• CVE-2026-25691 - CVSS 6.7 (medium), 2026-04-14: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox…
• CVE-2025-61886 - CVSS 5.4 (medium), 2026-04-14: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0…
• CVE-2025-53608 - CVSS 4.8 (medium), 2026-03-10: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0…
• CVE-2025-52436 - CVSS 9.6 (critical), 2026-02-10: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0…
• CVE-2025-67685 - CVSS 3.8 (low), 2026-01-13: A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions,…
• CVE-2025-54353 - CVSS 6.1 (medium), 2025-12-09: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0…
• CVE-2025-53949 - CVSS 8.8 (high), 2025-12-09: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox…
• CVE-2025-53679 - CVSS 7.2 (high), 2025-12-09: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox…
• CVE-2025-46215 - CVSS 5.3 (medium), 2025-11-18: An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7,…
• CVE-2024-27779 - CVSS 6.7 (medium), 2025-07-18: An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions,…
• CVE-2021-26105 - CVSS 8.8 (high), 2025-03-24: A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an…
• CVE-2024-54027 - CVSS 8.2 (high), 2025-03-17: A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below,…
• CVE-2024-54026 - CVSS 8.8 (high), 2025-03-11: An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all…
• CVE-2024-54018 - CVSS 7.2 (high), 2025-03-11: Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker…
• CVE-2024-52960 - CVSS 8.8 (high), 2025-03-11: A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows…
• CVE-2024-52961 - CVSS 8.8 (high), 2025-03-11: An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0…
• CVE-2024-45328 - CVSS 7.8 (high), 2025-03-11: An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI…
• CVE-2024-27781 - CVSS 9 (critical), 2025-02-11: An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4,…
• CVE-2024-27778 - CVSS 8.8 (high), 2025-01-14: An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4,…
• CVE-2024-31490 - CVSS 6.5 (medium), 2024-09-10: An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6,…
• CVE-2024-31491 - CVSS 8.8 (high), 2024-05-14: A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker…
• CVE-2024-21756 - CVSS 8.8 (high), 2024-04-09: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3,…
• CVE-2024-31487 - CVSS 6.5 (medium), 2024-04-09: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox…
• CVE-2024-23671 - CVSS 8.1 (high), 2024-04-09: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox…
• CVE-2024-21755 - CVSS 8.8 (high), 2024-04-09: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3,…
• CVE-2023-47541 - CVSS 6.7 (medium), 2024-04-09: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox…
• CVE-2023-47540 - CVSS 6.7 (medium), 2024-04-09: An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2,…
• CVE-2023-45587 - CVSS 5.4 (medium), 2023-12-13: An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2,…
• CVE-2023-41844 - CVSS 5.4 (medium), 2023-12-13: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2,…
• CVE-2023-41681 - CVSS 7.5 (high), 2023-10-13: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1,…
• CVE-2023-41843 - CVSS 7.5 (high), 2023-10-13: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1,…
• CVE-2023-41680 - CVSS 7.5 (high), 2023-10-13: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1,…
• CVE-2023-41836 - CVSS 6.1 (medium), 2023-10-13: An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1…
• CVE-2023-41682 - CVSS 8.1 (high), 2023-10-13: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through…
• CVE-2022-22305 - CVSS 5.4 (medium), 2023-09-01: An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below;…
• CVE-2022-27487 - CVSS 8.8 (high), 2023-04-11: A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0,…
• CVE-2022-27485 - CVSS 6.5 (medium), 2023-04-11: A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0…
• CVE-2022-26115 - CVSS 7.5 (high), 2023-02-16: A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to…
• CVE-2022-30305 - CVSS 7.5 (high), 2022-12-06: An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0,…
• CVE-2020-29013 - CVSS 5.4 (medium), 2022-04-06: An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the…
• CVE-2021-32591 - CVSS 5.3 (medium), 2021-12-08: A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before…
• CVE-2020-29012 - CVSS 5.6 (medium), 2021-09-08: An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs…
• CVE-2020-15939 - CVSS 4.3 (medium), 2021-09-06: An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged…
• CVE-2021-22124 - CVSS 7.5 (high), 2021-08-04: An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and…
• CVE-2021-24014 - CVSS 6.1 (medium), 2021-08-04: Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated…
• CVE-2021-26096 - CVSS 8.8 (high), 2021-08-04: Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory…
• CVE-2020-29011 - CVSS 8.8 (high), 2021-08-04: Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may…
• CVE-2021-26097 - CVSS 8.8 (high), 2021-08-04: An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through…
• CVE-2021-24010 - CVSS 8.1 (high), 2021-08-04: Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an…
• CVE-2021-26098 - CVSS 7.5 (high), 2021-08-04: An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about…
• CVE-2021-22125 - CVSS 7.2 (high), 2021-07-20: An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to…
• CVE-2020-29014 - CVSS 6.3 (medium), 2021-07-09: A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an…
• CVE-2018-1356 - CVSS 6.1 (medium), 2019-04-09: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via…