Description
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests.
Published: 2026-03-10
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: OS Command Injection leading to arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

An OS command injection flaw (CWE-78) exists in Fortinet FortiSandbox Cloud 5.0.4 where the system fails to neutralize special elements in an os command. An attacker who has super‑admin privileges and CLI access can craft a malicious HTTP request that causes the platform to run arbitrary commands on the host, resulting in unauthorized code execution with the appliance's privileges and the potential for full system compromise.

Affected Systems

The affected product is Fortinet FortiSandbox Cloud version 5.0.4. The related CPE identifiers reference this version, and no other versions are listed as vulnerable.

Risk and Exploitability

The CVSS score of 6.7 signifies moderate severity, while the EPSS of less than 1% suggests a low likelihood of exploitation. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires attackers to already possess super‑admin credentials and CLI access, limiting risk to insiders or compromised accounts but still representing a significant threat if such access is obtained.

Generated by OpenCVE AI on April 15, 2026 at 15:08 UTC.

Remediation

Vendor Solution

Fortinet remediated this issue in FortiSandbox Cloud version 5.0.5 and hence customers do not need to perform any action. Upgrade to FortiSandbox PaaS version 5.0.5 or above

OpenCVE Recommended Actions

  • Upgrade FortiSandbox Cloud to version 5.0.5 or later
  • Restrict super‑admin users and CLI access to trusted personnel only
  • Apply network segmentation or firewall rules to isolate the FortiSandbox Cloud service from external networks

Generated by OpenCVE AI on April 15, 2026 at 15:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in FortiSandbox Cloud 5.0.4

Wed, 18 Mar 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Fortinet fortisandbox Cloud
CPEs cpe:2.3:a:fortinet:fortisandbox_cloud:5.0.4:*:*:*:*:*:*:*
Vendors & Products Fortinet fortisandbox Cloud

Tue, 10 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Description An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests.
First Time appeared Fortinet
Fortinet fortisandboxcloud
Weaknesses CWE-78
CPEs cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortisandboxcloud
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'}

Subscriptions

Fortinet Fortisandbox Cloud Fortisandboxcloud
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-04-14T15:38:23.184Z

Reserved: 2026-02-06T08:48:58.542Z

Link: CVE-2026-25836

cve-icon Vulnrichment

Updated: 2026-03-10T20:30:12.938Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-10T18:18:38.090

Modified: 2026-03-18T13:04:12.167

Link: CVE-2026-25836

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T17:00:07Z

Weaknesses