Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiSandbox | 5.0.0 – ≤ 5.0.1, 4.4.0 – ≤ 4.4.7, 4.2.1 – ≤ 4.2.8, 4.0.0 – ≤ 4.0.6 | — |
Advisories 2
- NCSC-2026-0060 Kwetsbaarheden verholpen in Fortinet FortiSandbox, FortiAuthenticator en FortiClient NCSC-NL (Netherlands) · Feb 11, 2026
- WID-SEC-2026-0385 Fortinet FortiSandbox: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Feb 10, 2026