The vulnerability is a missing authorization check that permits unauthenticated HTTP requests to perform privileged operations in Fortinet FortiSandbox and its Cloud and PaaS variants. An attacker can send crafted requests that result in execution of arbitrary code or system commands, potentially compromising the sandbox and its integrity. The weakness is classified as CWE‑862 and exposes the integrity and availability of the affected systems.

Affected are FortiSandbox 5.0.0‑5.0.1, 4.4.0‑4.4.8, and all 4.2 releases; FortiSandbox Cloud 5.0.0‑5.0.1 and 4.4.5‑4.4.8; and FortiSandbox PaaS 5.0.0‑5.0.1, 4.4.5‑4.4.8, and the 21.3‑23.4 series in all subsequent releases. Administrators should check its deployment version against these ranges to assess exposure.

The CVSS score of 9.1 places the vulnerability in the critical severity band. The EPSS score of less than 1 % indicates a low current exploitation probability, but the remote nature of the flaw means an attacker can trigger it from any network that can reach the FortiSandbox interface. Because the issue is not listed in CISA’s KEV catalog it has not been confirmed in the wild yet; however the flaw still enables unrestricted command execution and therefore poses a significant threat to system integrity and confidentiality.