Loading vulnerability…
OS Command Injection in Fortinet FortiSandbox GUI
CVE-2025-53949 is an OS command injection vulnerability in multiple Fortinet FortiSandbox GUI endpoints. Insufficient neutralization of special elements in OS command construction allows an authenticated attacker to submit crafted HTTP requests that execute unauthorized commands or code on the underlying FortiSandbox system. Affected releases are FortiSandbox 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, and all 4.2.x and 4.0.x versions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated remote attacker can execute arbitrary unauthorized operating-system commands or code in the context of the vulnerable FortiSandbox appliance. Successful exploitation can compromise the confidentiality, integrity, and availability of the underlying system and may result in full appliance compromise.
If you can’t patch tonight, do this now.
No vendor-provided temporary workaround is available. Until remediation is complete, restrict FortiSandbox GUI access to trusted authenticated administrators, limit GUI network exposure, and monitor for anomalous or malicious HTTP requests to administrative endpoints.
Patch, then assume compromise.
Upgrade FortiSandbox 5.0.0 through 5.0.2 to version 5.0.3 or later, and FortiSandbox 4.4.0 through 4.4.7 to version 4.4.8 or later. Deployments running the 4.2.x or 4.0.x branches should be migrated to a supported fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.