CVE-2024-52961: Fortinet FortiSandbox

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2.1 through 4.2.7, FortiSandbox 4.0.0 through 4.0.5, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.

Affected products

• Fortinet FortiSandbox: from 3.0.0, before 4.0.6 (fixed in 4.0.6); from 4.2.0, before 4.2.8 (fixed in 4.2.8); from 4.4.0, before 4.4.7 (fixed in 4.4.7); version 5.0.0 only

Published 2025-03-11. Last modified 2026-06-17.