cbcvebase.

Fortinet Fortisandbox vulnerabilities

65 known vulnerabilities affecting fortinet/fortisandbox.

Total CVEs
65
CISA KEV
2
actively exploited
Public exploits
2
Exploited in wild
3
Severity breakdown
CRITICAL8HIGH25MEDIUM30LOW2

Vulnerabilities

Page 4 of 4
CVE-2022-22305P4MEDIUMCVSS 4.2≥ 3.0.0, ≤ 3.0.7≥ 3.1.0, ≤ 3.1.5+6 more2023-09-01
CVE-2022-22305 [MEDIUM] CWE-297 CVE-2022-22305: An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 an An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some
nvd
CVE-2024-54027P4MEDIUMCVSS 4.4≥ 3.0.5, < 4.0.6≥ 4.2.0, < 4.2.8+8 more2025-03-17
CVE-2024-54027 [MEDIUM] CWE-321 CVE-2024-54027: A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and belo A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access to read sensitive data via CLI.
nvd
CVE-2025-67685P4LOWCVSS 3.8≥ 4.0.0, < 5.0.5≥ 5.0.0, ≤ 5.0.4+3 more2026-01-13
CVE-2025-67685 [LOW] CWE-918 CVE-2025-67685: A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.
nvd
CVE-2026-27316P4LOWCVSS 2.7≥ 4.4.0, < 5.0.6≥ 5.0.0, ≤ 5.0.5+1 more2026-04-14
CVE-2026-27316 [LOW] CWE-522 CVE-2026-27316: A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, F A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection.
nvd
CVE-2026-107656CRITICALCVSS 9.8≥ 5.0.0, ≤ 5.0.6≥ 4.4.0, ≤ 4.4.9+1 more2026-10-26
CVE-2026-107656 [CRITICAL] CWE-288 CVE-2026-107656: An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5 An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or c
nvd
← Previous4 / 4
Fortinet Fortisandbox vulnerabilities | cvebase