Known vulnerabilities in FortiSandbox

Software: FortiSandbox
Software CPE: cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
Total vulnerabilities: 66
Public exploits: 6
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiSandbox FortiSandbox is affected by 66 known vulnerabilities: 2 critical, 4 high, 34 medium, 26 low Critical High Medium Low

Vulnerabilities (66)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137522 - Exposure of resource to wrong sphere
CVE-2026-59835
CWE-668 High
No
No
4.4.9, 5.0.3 14.07.2026 SB2026071489
#VU134004 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-25089
CWE-78 High
No
Exploited
4.4.9, 5.0.6 09.06.2026 SB2026060944
#VU131203 - Missing Authorization
CVE-2026-26083
CWE-862 High
No
No
4.4.9, 5.0.2 12.05.2026 SB2026051376
#VU126116 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-25691
CWE-22 Low
No
No
4.4.9, 5.0.6 15.04.2026 SB2026041519
#VU126115 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-39812
CWE-79 Low
No
No
4.4.9, 5.0.6 15.04.2026 SB2026041518
#VU126114 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-61886
CWE-79 Low
No
No
5.0.5 15.04.2026 SB2026041517
#VU126112 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-39808
CWE-78 Critical
Available
Exploited
4.4.9 15.04.2026 SB2026041515
#VU125998 - Insufficiently Protected Credentials
CVE-2026-27316
CWE-522 Low
No
No
5.0.6 14.04.2026 SB20260414122
#VU125997 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-39813
CWE-22 Critical
No
No
4.4.9, 5.0.6 14.04.2026 SB20260414121
#VU123704 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-53608
CWE-79 Low
No
No
4.4.8, 5.0.3 10.03.2026 SB2026031069
#VU122531 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-52436
CWE-79 Low
No
No
4.4.8, 5.0.2 10.02.2026 SB2026021040
#VU121223 - Server-Side Request Forgery (SSRF)
CVE-2025-67685
CWE-918 Low
No
No
5.0.5 13.01.2026 SB2026011362
#VU119453 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-54353
CWE-79 Medium
No
No
4.4.8, 5.0.3 09.12.2025 SB2025120962
#VU119452 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-53949
CWE-78 Low
No
No
4.4.8, 5.0.3 09.12.2025 SB2025120961
#VU119430 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-53679
CWE-78 Low
No
No
4.4.8, 5.0.3 09.12.2025 SB2025120946
#VU118596 - Improper isolation or compartmentalization
CVE-2025-46215
CWE-653 Medium
No
No
4.4.8, 5.0.2 18.11.2025 SB2025111865
#VU112471 - Insufficient Session Expiration
CVE-2024-27779
CWE-613 Low
No
No
4.2.7, 4.4.5 08.07.2025 SB2025070836
#VU107353 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-27778
CWE-78 Medium
No
No
4.0.5, 4.2.7, 4.4.5 10.04.2025 SB2025041031
#VU107309 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-27781
CWE-79 Low
No
No
4.0.5, 4.2.7, 4.4.5 09.04.2025 SB2025040974
#VU105623 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-52961
CWE-78 Medium
No
No
4.0.6, 4.2.8, 4.4.7, 5.0.1 12.03.2025 SB2025031213


Showing elements 1 - 20 out of 66