725 matches found
CVE-2026-39808
CVE-2026-39808 2025년 11월, Fortinet의 FortiSandbox에서 인증되지 않은 공격자가 기본 OS에서 루트 권한으로 명령을 실행할 수 있는 심각한 취약점이 발견되었습니다. 이 취약점은 패치되었고 2026년 4월에 마침내 공개되었습니다. 이 취약점은 FortiSandbox 버전 4.4.0부터 4.4.8까지 영향을 줍니다. 전체 보안 권고는 여기에서 읽을 수 있습니다. 취약점 이 취약점은 /fortisandbox/job-detail/tracer-behavior 엔드포인트에 영향을 줍니다. OS 명령은 j...
CVE-2026-39813
🛡️ CVE-2026-39813 - Fortinet FortiSandbox パストラバーサル脆弱性 📌 概要 CVE-2026-39813 は、Fortinet FortiSandbox に影響を与える重大なパストラバーサル脆弱性 です。 この脆弱性は、ユーザーが指定したファイルパスの検証が不適切であるために発生し、攻撃者が ../ などのディレクトリトラバーサルシーケンスを操作して、意図されたディレクトリ構造の外部にある不正なファイルにアクセスできるようになります。 ⚠️ 影響を受けるバージョン この問題は以下のバージョンに影響します: FortiSandbox 4.4.0 –...
FortiSandbox-RCE-Exploit-CVE-2026-39808
FortiSandbox RCE スキャナー — CVE-2026-39808 Fortinet FortiSandbox における認証不要の root 権限 OS コマンドインジェクション 脆弱性 • インストール • 使用方法 • 動作原理 • パイプライン • Shodan ダーク • 免責事項 脆弱性 CVE-2026-39808 は、Fortinet FortiSandbox における深刻な認証不要の OS コマンドインジェクション脆弱性です。/fortisandbox/job-detail/tracer-behavior API エンドポイントは jid...
Vulnerabilities found in Fortinet’s Forti-products
Fortinet has identified vulnerabilities in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM, and FortiSOAR. These vulnerabilities involve various types of errors in multiple Fortinet products. The mos...
CVE-2026-39808
🚨 FortiSandbox 루트 샌드박스 탈출 - CVE-2026-39808 🎯 개요 이 저장소는 Fortinet FortiSandbox의 치명적인 인증 없는 명령 주입 취약점인 CVE-2026-39808 에 대한 깔끔하고 잘 문서화된 개념 증명PoC을 포함합니다. 이 취약점은 샌드박스 탈출 및 rootuid=0 권한으로 원격 코드 실행을 허용합니다. 이 PoC가 시연하는 내용: jid 매개변수를 통한 경로 탐색Path Traversal + 명령 주입Command Injection 분석 환경에서 샌드박스 탈출 root 권한으로...
Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the cronValue parameter passed to the writeremotebackuptocrontab...
CVE-2026-84387
A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...
CVE-2026-26084
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...
CVE-2026-26084
Fortinet FortiSandbox is affected by an improper access control vulnerability (CVE-2026-26084) that may allow an unauthenticated, remote attacker to access sensitive information via crafted HTTP requests . Affected versions include FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, FortiSandbox Cloud 5.0.4–5...
CVE-2026-26084
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...
EUVD-2026-72926
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...
CVE-2026-84387
CVE-2026-84387 is a command injection vulnerability in Fortinet FortiSandbox affecting versions 5.2.0 , 5.0.0 through 5.0.6 , and 4.4.0 through 4.4.9 . The flaw involves improper neutralization of special elements in a command, potentially allowing an attacker to execute unauthorized code or comm...
CVE-2026-84387
A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...
EUVD-2026-72922
A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...
CVE-2026-84387
A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...
CVE-2026-25089
🚨 CVE-2026-25089 - FortiSandbox의 치명적인 OS Command Injection 📖 개요 CVE-2026-25089 은 여러 Fortinet FortiSandbox 배포에 영향을 미치는 치명적인 OS Command Injection CWE-78 취약점입니다. 인증되지 않은 원격 공격자는 특수하게 조작된 HTTP 요청을 전송하여 이 결함을 악용할 수 있으며, 이를 통해 기본 운영 체제에서 임의의 명령 실행이 가능합니다. ⚠️ 성공적인 악용 시 어플라이언스 전체가 손상되고 원격 코드 실행RCE으로 이어질 수...
CVE-2026-25089
CVE-2026-25089 - ドラフト - Fortinet FortiSandbox ⚡ 簡単な使い方 このプロジェクトは、以下のような安全で許可された環境でのみ使用してください。 ローカル仮想マシン Dockerコンテナ 隔離されたラボ環境 許可されたペネトレーションテスト環境 セットアップ例: root@kitploit: git clone https://github.com/HORKimhab/CVE-2026-25089 cd CVE-2026-25089 Project use python follow below Create a virtual...
PT-2026-87171
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...
