CVE-2025-53949
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
An OS Command Injection vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, and 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.
Risk Assessment
An authenticated attacker can execute arbitrary code on the system, potentially leading to full device compromise.
Recommendation
Upgrade to a patched version as recommended by the vendor.
Other vulnerabilities in FortiSandbox
See all- CVE-2026-25089CriticalActively exploited
An OS command injection vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5). An unauthenticated attacker can execute unauthorized commands via crafted HTTP requests.
- CVE-2026-26083Critical
A missing authorization vulnerability in Fortinet FortiSandbox allows an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. The issue affects multiple versions of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
- CVE-2026-39808CriticalActively exploited
An OS command injection vulnerability has been discovered in Fortinet FortiSandbox versions 4.4.0 through 4.4.8. This flaw is due to improper neutralization of special elements used in OS commands.
- CVE-2026-84387High
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
- CVE-2026-59835High
A vulnerability in Fortinet FortiSandbox versions 5.0.0-5.0.2 and 4.4.3-4.4.8 allows an unauthenticated attacker to access the VNC server of scanning VMs. The issue is due to improper resource access restrictions.
Original NVD description (English source)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS