Fortinet FortiSandbox Cloud vulnerabilities

11 CVEs affecting Fortinet FortiSandbox Cloud, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106172, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability, published 2026-06-09. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-07-16. EPSS: 76.1% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox…
CVE-2025-53679, published 2025-12-09. High severity, CVSS 7.2. EPSS: 12.2% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0…
CVE-2026-25836, published 2026-03-10. High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged…
CVE-2026-26083, published 2026-05-12. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions,…
CVE-2026-25691, published 2026-04-14. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all…
CVE-2024-54026, published 2025-03-11. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions,…
CVE-2026-26084, published 2026-09-08. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5…
CVE-2026-27316, published 2026-04-14. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed…
CVE-2025-61886, published 2026-04-14. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0…
CVE-2026-39812, published 2026-04-14. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2…

Latest

CVE-2026-106172, published 2026-10-13. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through…