CVE-2025-46215
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An improper isolation or compartmentalization vulnerability (CWE-653) in Fortinet FortiSandbox (5.0.0–5.0.1, 4.4.0–4.4.7, 4.2 all versions, 4.0 all versions) may allow an unauthenticated attacker to evade sandbox scanning via a crafted file.
Risk Assessment
Evading sandbox scanning may allow a malicious file to reach a protected environment undetected, increasing the risk of infection and security compromise.
Recommendation
Update FortiSandbox to the version containing the Fortinet fix. Additionally, deploy layered detection mechanisms and do not rely solely on the sandbox.
Other vulnerabilities in FortiSandbox
See all- CVE-2026-25089CriticalActively exploited
An OS command injection vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5). An unauthenticated attacker can execute unauthorized commands via crafted HTTP requests.
- CVE-2026-26083Critical
A missing authorization vulnerability in Fortinet FortiSandbox allows an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. The issue affects multiple versions of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
- CVE-2026-39808CriticalActively exploited
An OS command injection vulnerability has been discovered in Fortinet FortiSandbox versions 4.4.0 through 4.4.8. This flaw is due to improper neutralization of special elements used in OS commands.
- CVE-2025-53949High
An OS Command Injection vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, and 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.
- CVE-2026-106172Medium
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox (including Cloud versions) may allow an attacker to escalate privileges via specially crafted HTTP requests.
- CVE-2026-106170Medium
An Uncaught Exception vulnerability [CWE-248] in Fortinet FortiSandbox may allow a privileged attacker to persistently deny access to the GUI and CLI via crafted HTTP requests.
- CVE-2026-84387High
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
- CVE-2026-59835High
A vulnerability in Fortinet FortiSandbox versions 5.0.0-5.0.2 and 4.4.3-4.4.8 allows an unauthenticated attacker to access the VNC server of scanning VMs. The issue is due to improper resource access restrictions.
- CVE-2025-61886Medium
Cross-Site Scripting (XSS) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4 and FortiSandbox PaaS 5.0.0 through 5.0.4. An attacker can perform an XSS attack via crafted HTTP requests.
Original NVD description (English source)
An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS