815 matches found
CVE-2026-26083
CVE-2026-26083 describes a missing authorization vulnerability in Fortinet FortiSandbox products (versions ranging from FortiSandbox 4.4.x/5.0.x to FortiSandbox Cloud 5.0.2–5.0.5 and FortiSandbox PaaS 21.3–23.4, including 22.1–22.2, 5.0.0–5.0.1, and 4.4.5–4.4.8). The issue allows an unauthenticat...
Fortinet FortiSandbox 安全漏洞
Fortinet FortiSandbox is an APT Advanced Persistent Threat protection device developed by the American company Fortinet. This device offers features such as dual sandbox technology, dynamic threat intelligence systems, real-time control panels, and reporting capabilities. Security vulnerabilities...
Incorrect global authorization
...
CVE-2026-26083: Missing Authorization
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all...
CVE-2026-39808
A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via...
Exploit for OS Command Injection in Fortinet Fortisandbox
FortiSandbox RCE Scanner — CVE-2026-39808...
The vulnerability of the FortiSandbox threat detection and mitigation system, related to the lack of protection for website structures, allows attackers to execute arbitrary commands or code.
The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands or code...
The vulnerability of the FortiSandbox threat detection and mitigation system, related to the use of files and directories accessible from external parties, allows a intruder to gain unauthorized access to protected information.
The vulnerability of the FortiSandbox threat detection and mitigation system lies in the use of files and directories accessible from external parties. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of the FortiSandbox threat detection and mitigation system lies in its failure to protect the structure of web pages. This allows attackers to perform cross-site scripting attacks (XSS).
The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using specially crafted HTTP requests...
The vulnerability of the FortiSandbox threat detection and mitigation system lies in its ability to bypass the restricted access catalog, allowing attackers to increase their privileges.
The vulnerability of the FortiSandbox threat detection and mitigation system is related to the possibility of bypassing the restricted access catalog. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
Exploit for CVE-2026-39808
🚨 FortiSandbox Root Sandbox Escape - CVE-2026-39808 ----...
The vulnerability of the graphical user interface of the FortiSandbox threat detection and mitigation system allows a violator to delete any arbitrary directory.
The vulnerability of the graphical user interface of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to delete any directory by sending speciall...
📄 Fortinet FortiSandbox 4.4.8 Remote Command Execution
Fortinet FortiSandbox versions 4.4.0 through 4.4.8 suffer from a remote command execution vulnerability. CVE-2026-39808 On November 2025, a critical vulnerability was discovered on Fortinet's FortiSandbox which allowed an unauthenticated attacker to execute commands in the underlying OS as root...
The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system allows a perpetrator to execute arbitrary code.
The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system is related to the failure to eliminate special elements “|” when processing the jid parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending...
vulnerabilities in Fortinet FortiSandbox
Fortinet has identified several vulnerabilities in FortiSandbox, including those in on-premises versions and FortiSandbox Cloud. Two of these vulnerabilities are classified as critical by Fortinet. Malicious actors can exploit these vulnerabilities through CVE-2026-39813 and CVE-2026-39808. In...
Fortinet FortiSandbox Cross-site Scripting Vulnerability (CNVD-2026-25595)
Fortinet FortiSandbox is a advanced threat protection solution, primarily used for detecting and analyzing malware and unknown threats. Fortinet FortiSandbox has a cross-site scripting vulnerability. This vulnerability stems from the failure to properly neutralize user inputs during web page...
EUVD-2026-22342
A improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8,...
EUVD-2026-22344
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via...
EUVD-2026-22333
A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection...
EUVD-2026-22338
A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via...