EUVD-2026-35443
GHSA-gw24-hwf5-92h2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (fortinet) · only source for this CVE.
CVSS VectorVendor: fortinet
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests
Articles & Coverage 1
AnalysisAI
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attackers to execute arbitrary operating system commands by sending specifically crafted HTTP requests to the management interface. The flaw carries a CVSS 9.8 rating with network-reachable, no-authentication, no-user-interaction characteristics, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs only network reachability to the FortiSandbox HTTP service and the ability to send a specifically crafted HTTP request - no credentials, no user interaction, and no non-default toggle is called out in the advisory, consistent with PR:N/UI:N/AC:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes the worst-case profile: remotely reachable, low complexity, no authentication, no user interaction, and full confidentiality/integrity/availability impact - consistent with a 9.8 critical score and with the description's wording of an unauthenticated attacker reaching the HTTP endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the FortiSandbox HTTP interface - for example a compromised internal host, or an internet-exposed management portal - sends a crafted HTTP request whose parameters contain shell metacharacters that the vulnerable handler passes unsanitized to an OS command, yielding code execution under the service account. From that foothold the attacker can read submitted sample files and analysis verdicts, tamper with detection logic to whitelist their own malware, and pivot into the management fabric the sandbox is trusted to talk to (FortiGate, FortiAnalyzer, mail gateways). … |
| Remediation | Patch available per vendor advisory FG-IR-26-141 (https://fortiguard.fortinet.com/psirt/FG-IR-26-141) - consult that page for the exact fixed builds on the 5.0.x and 4.4.x branches and upgrade FortiSandbox on-premise appliances accordingly; FortiSandbox Cloud and PaaS tenants should confirm with Fortinet that the managed service has been remediated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all FortiSandbox instances (on-premise, Cloud, and PaaS); audit network accessibility of management interfaces; enable detailed logging and alerting for suspicious HTTP requests to management endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today