CVE-2025-53679: Fortinet FortiSandbox

High severity, CVSS 7.2. EPSS: 12.3% chance of exploitation in the next 30 days.

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

Affected products

• Fortinet FortiSandbox: from 4.0.0, before 4.4.8 (fixed in 4.4.8); from 5.0.0, before 5.0.3 (fixed in 5.0.3)
• Fortinet FortiSandbox Cloud: from 23.1.4245, before 23.4.4374 (fixed in 23.4.4374); version 24.1.4436 only

Published 2025-12-09. Last modified 2026-10-08.