FortiSandbox EUVD-2026-72922

High-privilege authenticated access to FortiSandbox is required - the CVSS PR:H metric establishes that exploitation is limited to users holding administrative or equivalent credentials on the appliance. The attack is reachable over the network (AV:N) with low complexity (AC:L) and requires no user interaction. The specific interface, endpoint, or parameter containing the injection point has NOT been publicly disclosed (description contains a placeholder). Exploitation is therefore limited to: (1) actors who already possess or can compromise FortiSandbox admin credentials, (2) insiders with administrative access, or (3) attackers who pivot from a previously compromised admin session. Unauthenticated remote exploitation is NOT supported by the CVSS vector. Non-default network exposure of the management interface would further constrain real-world reachability.

The base CVSS score of 6.7 is tempered by PR:H, which requires admin-level credentials - significantly limiting the realistic attacker pool compared to unauthenticated exploits. However, all three impact dimensions are maxed (C:H/I:H/A:H), meaning successful exploitation yields full system compromise of the FortiSandbox appliance. The temporal vector E:F confirms functional exploit code exists, raising practical risk above paper severity; RL:O confirms vendor has released a fix; RC:C confirms the vulnerability. FortiSandbox is a security-critical appliance that may have privileged network access for inspecting internal traffic, making compromise particularly damaging - lateral movement or interception of sandbox telemetry are realistic post-exploitation scenarios. EPSS data is not provided; given the PR:H requirement and niche product, opportunistic mass exploitation is unlikely, but targeted attacks against FortiSandbox admin panels by advanced actors are plausible. CRITICAL NOTE: The CVE description contains the literal placeholder text 'via <insert attack vector here>' - the specific vulnerable interface, parameter, or endpoint has not been publicly disclosed, limiting independent verification of exact exploitation conditions.

An attacker with administrative credentials to the FortiSandbox web management interface or API sends a crafted request containing OS shell metacharacters to the vulnerable parameter. The application forwards the unsanitized input to an OS command interpreter, executing arbitrary commands as the underlying system user - likely root given appliance architecture - granting the attacker full control of the sandbox appliance. A functional exploit (E:F) has been confirmed to exist, suggesting this attack path has been demonstrated.