FO
Product
FortiSandbox
On CISA KEVExploited in the wild
65
CVEs
2
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 8High 25Medium 30Low 2
Watch
Add FortiSandbox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-53949 | 8.8 | Dec 9 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2,… Affected: 4.0.0 through 4.0.6; 4.2.0 through 4.2.8; 4.4.0 through 4.4.7; 5.0.0 through 5.0.2 |
| CVE-2021-26105 | 8.8 | Mar 24 | A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authenticated attacker to… Affected: 3.1.0 through 3.1.4; 3.2.0 before 3.2.3; 4.0.0 |
| CVE-2024-54026 | 8.8 | Mar 11 | An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox… Affected: 3.0.0 before 4.4.7 |
| CVE-2024-52961 | 8.8 | Mar 11 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6,… Affected: 3.0.0 before 4.0.6; 4.2.0 before 4.2.8; 4.4.0 before 4.4.7; 5.0.0 |
| CVE-2024-52960 | 8.8 | Mar 11 | A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated… Affected: 3.0.0 before 4.2.8; 4.4.0 before 4.4.7; 5.0.0 |
| CVE-2024-27778 | 8.8 | Jan 14 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through… Affected: 3.0.5 before 4.0.5; 4.2.0 before 4.2.7; 4.4.0 before 4.4.5 |
| CVE-2024-31491 | 8.8 | May 14 | A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute… Affected: 4.2.0 before 4.2.7; 4.4.0 before 4.4.5 |
| CVE-2024-21756 | 8.8 | Apr 9 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through… Affected: 4.0.0 before 4.0.5; 4.2.0 before 4.2.7; 4.4.0 before 4.4.4 |
| CVE-2024-21755 | 8.8 | Apr 9 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through… Affected: 4.0.0 before 4.0.5; 4.2.0 before 4.2.7; 4.4.0 before 4.4.4 |
| CVE-2022-27487 | 8.8 | Apr 11 | A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and… Affected: 2.5.0 before 3.2.4; 4.0.0 before 4.0.3; 4.2.0 before 4.2.3 |
| CVE-2021-26096 | 8.8 | Aug 4 | Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content… Affected: through 3.1.4; 3.2.0 before 3.2.3 |
| CVE-2021-26097 | 8.8 | Aug 4 | An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6 may allow an… Affected: before 3.0.7; 3.1.0 before 3.1.5; 3.2.0 before 3.2.3 |
| CVE-2020-29011 | 8.8 | Aug 4 | Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an… Affected: before 3.1.5; 3.2.0 before 3.2.2 |
| CVE-2026-59835 | 8.6 | Jul 14 | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access… Affected: 5.0.0 through 5.0.2; 4.4.3 through 4.4.8 |
| CVE-2024-23671 | 8.1 | Apr 9 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6,… Affected: 4.0.0 before 4.0.5; 4.2.0 before 4.2.7; 4.4.0 before 4.4.4 |
| CVE-2024-45328 | 7.8 | Mar 11 | An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI… Affected: 4.4.0 before 4.4.7 |
| CVE-2023-41682 | 7.5 | Oct 13 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0… Affected: 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.2.0 through 3.2.4; 4.0.0 through 4.0.3; 4.2.0 through 4.2.5; 4.4.0 |
| CVE-2022-26115 | 7.5 | Feb 16 | A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 4.0.0; 4.0.1; +1 more |
| CVE-2022-30305 | 7.5 | Dec 6 | An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1,… Affected: 3.1.0 through 3.1.5; 4.0.0 through 4.0.2; 3.2.0; 3.2.1; 3.2.2; 3.2.3 |
| CVE-2021-22124 | 7.5 | Aug 4 | An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and… Affected: 3.0.0 before 3.0.7; 3.1.0 before 3.1.5; 3.2.0 before 3.2.2 |
| CVE-2021-26098 | 7.5 | Aug 4 | An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the… Affected: through 3.1.4; 3.2.0 before 3.2.3 |
| CVE-2026-84387 | 7.2 | Sep 8 | A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox… Affected: 5.2.0; 5.0.0 through 5.0.6; 4.4.0 through 4.4.9; 4.2.1 through 4.2.8 |
| CVE-2025-53679 | 7.2 | Dec 9 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2,… Affected: 4.0.0 before 4.4.8; 5.0.0 before 5.0.3 |
| CVE-2024-54018 | 7.2 | Mar 11 | Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute… Affected: 3.2.0 before 4.4.6 |
| CVE-2021-22125 | 7.2 | Jul 20 | An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the… Affected: before 3.2.2 |
Showing 25