FO
Product
FortiSandbox
On CISA KEVExploited in the wild
65
CVEs
2
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 8High 25Medium 30Low 2
Watch
Add FortiSandbox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-41843 | 5.4 | Oct 13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through… Affected: 2.5.0 through 2.5.2; 3.0.0 through 3.0.7; 3.1.0 through 3.1.5; 3.2.0 through 3.2.4; 4.0.0 through 4.0.3; 4.2.0 through 4.2.5; +2 more |
| CVE-2020-29013 | 5.4 | Apr 6 | An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically… Affected: through 3.1.4; 3.2.0; 3.2.1 |
| CVE-2026-106172 | 5.3 | Oct 13 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox… Affected: 5.2.0 through 5.2.1; 5.0.0 through 5.0.6; 4.4.0 through 4.4.10 |
| CVE-2025-46215 | 5.3 | Nov 18 | An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all… Affected: 4.0.0 before 4.4.8; 5.0.0 before 5.0.2 |
| CVE-2021-32591 | 5.3 | Dec 8 | A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before… Affected: 3.2.0 through 3.2.2; 4.0.0 |
| CVE-2020-29012 | 5.3 | Sep 8 | An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information… Affected: before 3.2.2 |
| CVE-2020-29014 | 5.3 | Jul 9 | A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker… Affected: before 3.2.2 |
| CVE-2026-106170 | 4.9 | Oct 13 | An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow… Affected: 5.2.0 through 5.2.1; 5.0.0 through 5.0.6; 4.4.0 through 4.4.10 |
| CVE-2026-39812 | 4.8 | Apr 14 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through… Affected: 5.0.0 through 5.0.4; 4.4.0 through 4.4.8; 4.2.1 through 4.2.8 |
| CVE-2025-53608 | 4.8 | Mar 10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2,… Affected: 4.0.0 before 4.4.8; 5.0.0 before 5.0.3 |
| CVE-2024-54027 | 4.4 | Mar 17 | A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below,… Affected: 3.0.5 before 4.0.6; 4.2.0 before 4.2.8; 4.4.0 before 4.4.7; 5.0.0 |
| CVE-2020-15939 | 4.3 | Sep 6 | An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the… Affected: before 3.1.5; 3.2.0 before 3.2.2 |
| CVE-2022-22305 | 4.2 | Sep 1 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and… Affected: 3.0.0 through 3.0.7; 3.1.0 through 3.1.5; 3.2.0 through 3.2.4; 3.0.1; 4.0.0; 4.0.1; +1 more |
| CVE-2025-67685 | 3.8 | Jan 13 | A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all… Affected: 4.0.0 before 5.0.5 |
| CVE-2026-27316 | 2.7 | Apr 14 | A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow… Affected: 5.0.0 through 5.0.5; 4.4.0 through 4.4.9 |