CVE-2025-54353

MediumCVSS 5.4

Published: 09/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.31%

93th percentile - higher than 93% of all known CVEs

Summary

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, and 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.

Risk Assessment

XSS attack can allow an attacker to execute scripts in the victim's browser, potentially leading to session theft or administrator account compromise.

Recommendation

Update FortiSandbox to a patched version if available. Restrict access to the management interface and apply input filters.

Other vulnerabilities in Fortinet FortiSandbox

CVE-2026-26084Critical
An improper access control vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, Cloud 5.0.4 through 5.0.5, and PaaS 5.0.4 through 5.0.5 may allow an attacker to access sensitive information via crafted HTTP requests.

Original NVD description (English source)

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS