FortiSandbox
CVE-2024-52960: Client-side enforcement of server-side security in FortiSandbox
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiSandbox 5.0 | 5.0.1 or later |
| FortiSandbox 4.4.0 to 4.4.6 | 4.4.7 or later |
| FortiSandbox 4.2.1 to 4.2.7 | 4.2.8 or later |
| FortiSandbox 4.0.0 to 4.0.6 | Upgrade past 4.0.6; see the advisory |
| FortiSandbox 3.2.0 to 3.2.4 | Upgrade past 3.2.4; see the advisory |
| FortiSandbox 3.1.0 to 3.1.5 | Upgrade past 3.1.5; see the advisory |
| FortiSandbox 3.0.0 to 3.0.7 | Upgrade past 3.0.7; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.