Fortisandbox Cloud vulnerabilities | LiveThreat CVE Feed

Product

Fortisandbox Cloud

by Fortinet · last CVE Jun 9, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities9 In the news3 Timeline

Severity mix

Critical 2High 3Medium 3Low 1

Severity

All severities9 Critical2 High3 Medium3 Low1

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Fortisandbox Cloud to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-25089 In wildKEV	9.8	76%	Jun 9	Fortinet FortiSandbox OS Command Injection Vulnerability Affected: 5.0.4 before 5.0.6
CVE-2026-26083	9.8	1%	May 12	A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS… Affected: 5.0.2 before 5.0.6; 23.1.4245 through 23.4.4374; 24.1.4436
CVE-2024-54026	8.8	0%	Mar 11	An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox… Affected: 24.1
CVE-2026-25836	7.2	2%	Mar 10	An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow… Affected: 5.0.4
CVE-2025-53679	7.2	12%	Dec 9	An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2,… Affected: 23.1.4245 before 23.4.4374; 24.1.4436
CVE-2026-25691	6.7	0%	Apr 14	A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8,… Affected: 5.0.4
CVE-2025-61886	5.4	0%	Apr 14	An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4,… Affected: 5.0.4
CVE-2026-39812	4.8	0%	Apr 14	A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through… Affected: 22.2.4134 through 23.1.4260; 23.3.4329 through 24.1.4436; 5.0.4; 5.0.5
CVE-2026-27316	2.7	0%	Apr 14	A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow… Affected: 5.0.4; 5.0.5