Fortinet FortiSandbox: Cross-site scripting in web UI
Summary
Cross-site scripting (CWE-79) in the web GUI of Fortinet FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS. An unauthenticated attacker can inject script code via crafted HTTP requests and social engineering, for example a link that an administrator opens. Successful exploitation runs script in the victim's browser session and can expose or manipulate the management interface. CVSS 3.1 base score 8.8.
Affected
- FortiSandbox 5.0.0 to 5.0.5
- FortiSandbox 4.4.0 to 4.4.8
- FortiSandbox 4.2 branch: scope disputed (CNA record lists 4.2.1 to 4.2.8, other sources say all 4.2 versions); confirm with Fortinet
- FortiSandbox Cloud 5.0.4 to 5.0.5
- FortiSandbox PaaS 5.0.4 to 5.0.5
Fixed in
- FortiSandbox 5.0: 5.0.6 or above
- FortiSandbox 4.4: 4.4.9 or above
- FortiSandbox Cloud 5.0: 5.0.6 or above
- FortiSandbox PaaS 5.0: 5.0.6 or above
- FortiSandbox 5.2 and PaaS 5.2: listed as not affected in the Fortinet table; the CNA record also names 5.2.0 or above
- FortiSandbox 4.2: Unknown.
Workaround
- No official workaround listed.
- Restrict access to the management interface to trusted networks and VPN; keep it off the public internet.
- Monitor logs for suspicious requests to the GUI.
Exploitation
- Public proof of concept reported, not verified.
- No evidence of exploitation in the wild found; not listed in CISA KEV at time of research.
Our recommendation
- Inventory all FortiSandbox, FortiSandbox Cloud and PaaS instances, including the 4.2 branch.
- Update to 5.0.6 or 4.4.9 (or the latest supported build); confirm the 4.2 fix with Fortinet.
- Until patched, restrict GUI access to management networks and VPN and confirm that no GUI is exposed to the internet.
- Check CISA KEV and the Fortinet PSIRT for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortinet PSIRT advisory FG-IR-26-142 fortiguard.fortinet.com
- CNA record text (Strix) www.strix.ai
- NVD mirror (threatint) cve.threatint.com
- Sibling Fortinet advisory FG-IR-26-110 fortiguard.fortinet.com
- OffSeq threat radar radar.offseq.com
- GBHackers article gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:22.
Original description (NVD)
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.