EUVD-2026-22342
GHSA-9q3x-6267-mffc
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
Stored cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 4.2 through 5.0.5 allows authenticated administrators with high privileges to inject malicious scripts into web pages, leading to unauthorized code execution when other users interact with compromised content. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity but not availability. With a CVSS score of 4.8 and high privilege requirement (PR:H), this represents a moderate risk primarily to multi-user deployments where administrative accounts may be compromised or untrusted.
Technical ContextAI
This is a stored cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in Fortinet's FortiSandbox malware analysis platform and its Platform-as-a-Service variant. The vulnerability exists in web page generation logic that fails to properly sanitize or encode user-supplied input before rendering it in HTTP responses. FortiSandbox is a security appliance used for advanced threat detection through dynamic malware analysis; the XSS flaw likely resides in the administrative console or reporting interface where authenticated users can submit input (such as report titles, malware sample names, or configuration parameters) that is subsequently displayed to other users without proper HTML encoding. The affected CPE identifiers (cpe:2.3:a:fortinet:fortisandbox and cpe:2.3:a:fortinet:fortisandbox_paas) encompass both the on-premises and cloud-hosted variants.
RemediationAI
Upgrade FortiSandbox to version 5.0.5 or later (for 5.0.x) or the latest available patch release for your version line. Fortinet has released patched versions addressing this vulnerability; consult https://fortiguard.fortinet.com/psirt/FG-IR-26-110 for exact fix versions corresponding to your current deployment. As an interim workaround pending patching, restrict administrative console access to trusted networks and trusted users only, audit administrator accounts for unauthorized activity, and implement Web Application Firewall (WAF) rules to detect and block XSS payloads in parameters passed to FortiSandbox web interfaces. For cloud-hosted FortiSandbox PaaS deployments, contact Fortinet support to confirm patch deployment status on shared infrastructure.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today