A missing authorization flaw (CWE-862) in Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS allows an attacker who does not have valid credentials to send crafted HTTP requests that result in the execution of arbitrary code or system commands. The vulnerability directly compromises the integrity and availability of the sandbox environment and can lead to data exfiltration or lateral movement within an organization.

The flaw affects Fortinet FortiSandbox versions 4.4.0 to 4.4.8 and 5.0.0 to 5.0.1, FortiSandbox Cloud versions 5.0.2 to 5.0.5, and all FortiSandbox PaaS releases from 21.3 up through 23.4, including the 5.0.x and 4.4.x lines. Administrators should verify the firmware or software version of their sandbox deployments against these ranges to determine exposure.

The CVSS score of 9.1 classifies the vulnerability as a critical risk, and the absence of an EPSS score does not reduce its severity. The issue is not listed in the CISA KEV catalog, but the attack can be executed remotely via HTTP without authentication, making it highly actionable from any environment where the FortiSandbox interface is exposed. The risk is significant for organizations that have not yet upgraded to the patched versions.