FortiSandbox vulnerabilities | LiveThreat CVE Feed

Product

FortiSandbox

by Fortinet · last CVE Oct 26, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

9.9

Max CVSS

New 30D

Vulnerabilities65 In the news5 Timeline

Severity mix

Critical 8High 25Medium 30Low 2

Severity

All severities65 Critical8 High25 Medium30 Low2

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add FortiSandbox to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-25089 In wildKEV	9.8	76%	Jun 9	Fortinet FortiSandbox OS Command Injection Vulnerability Affected: 5.0.0 through 5.0.5; 4.4.0 through 4.4.8; 4.2.1 through 4.2.8
CVE-2026-39808 In wildKEV	9.8	93%	Apr 14	Fortinet FortiSandbox OS Command Injection Vulnerability Affected: 4.4.0 through 4.4.8
CVE-2026-26084	9.9	0%	Sep 8	A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS… Affected: 5.0.0 through 5.0.5; 4.4.0 through 4.4.8; 4.2.1 through 4.2.8
CVE-2026-107656 New	9.8	1%	Oct 26	An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all… Affected: 5.0.0 through 5.0.6; 4.4.0 through 4.4.9; 4.2.1 through 4.2.8
CVE-2026-26083	9.8	1%	May 12	A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS… Affected: 5.0.0 through 5.0.1; 4.4.0 through 4.4.8; 4.2.1 through 4.2.8
CVE-2026-39813	9.8	22%	Apr 14	A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via… Affected: 5.0.0 through 5.0.5; 4.4.0 through 4.4.8
CVE-2025-52436	9.6	7%	Feb 10	An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1,… Affected: 5.0.0 through 5.0.1; 4.4.0 through 4.4.7; 4.2.1 through 4.2.8; 4.0.0 through 4.0.6
CVE-2024-27781	9.0	28%	Feb 11	An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through… Affected: 3.0.0 before 4.0.5; 4.2.0 before 4.2.7; 4.4.0 before 4.4.5