EUVD-2026-72922
GHSA-jq5j-gp3m-3mrh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface, but PR:H required; full triad impact consistent with OS-level command execution on appliance.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
4DescriptionCVE.org
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Articles & Coverage 1
AnalysisAI
Command injection in Fortinet FortiSandbox allows a remote, highly privileged attacker to execute arbitrary OS commands on the underlying system, achieving full confidentiality, integrity, and availability compromise. Affected versions span FortiSandbox 4.2.1-4.2.8, 4.4.0-4.4.9, 5.0.0-5.0.6, and 5.2.0, covering a wide release range across multiple major branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | High-privilege authenticated access to FortiSandbox is required - the CVSS PR:H metric establishes that exploitation is limited to users holding administrative or equivalent credentials on the appliance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The base CVSS score of 6.7 is tempered by PR:H, which requires admin-level credentials - significantly limiting the realistic attacker pool compared to unauthenticated exploits. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The temporal CVSS metric RL:O confirms an official fix has been released by Fortinet. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all FortiSandbox appliances running affected versions (4.2.1-4.2.8, 4.4.0-4.4.9, 5.0.0-5.0.6, 5.2.0) and audit administrative access logs for any suspicious privileged user activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fortisandbox
View allOS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
Path traversal in Fortinet FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 enables remote unauthenticated attackers to achieve
Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS varia
Remote code execution in Fortinet FortiSandbox 4.4.x through 5.0.x (on-premises, Cloud, and PaaS deployments) allows una
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerabi
A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandb
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenti
An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2,
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiS
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today