FortiSandbox Cloud vulnerabilities | LiveThreat CVE Feed

Product

FortiSandbox Cloud

by Fortinet · last CVE Oct 13, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

9.9

Max CVSS

New 30D

Vulnerabilities9 In the news3 Timeline

Severity mix

Critical 4High 3Medium 2Low 0

Severity

All severities9 Critical4 High3 Medium2 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add FortiSandbox Cloud to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-25089 In wildKEV	9.8	76%	Jun 9	Fortinet FortiSandbox OS Command Injection Vulnerability Affected: 5.0.4 through 5.0.5
CVE-2026-26084	9.9	0%	Sep 8	A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS… Affected: 5.0.4 through 5.0.5
CVE-2026-26083	9.8	1%	May 12	A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS… Affected: 5.0.0 through 5.0.1; 4.4.5 through 4.4.8
CVE-2026-39813	9.8	22%	Apr 14	A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via… Affected: 24.1; 23.4; 5.0.4 through 5.0.5
CVE-2024-54026	8.8	0%	Mar 11	An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox… Affected: 24.1
CVE-2026-25836	7.2	2%	Mar 10	An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow… Affected: 5.0.4
CVE-2025-53679	7.2	12%	Dec 9	An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2,… Affected: 24.1; 23.4
CVE-2026-25691	6.7	0%	Apr 14	A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8,… Affected: 5.0.4
CVE-2026-106172	5.3	0%	Oct 13	A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox… Affected: 5.0.4 through 5.0.6; 5.0.0 through 5.0.2; 4.4.0 through 4.4.9