FortiSandbox 4.4 vulnerabilities
9 advisories affect Fortinet FortiSandbox 4.4, 2 already exploited by attackers. Latest: October 13, 2026.
Running FortiSandbox 4.4 devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on FortiSandbox 4.4 alerts
Turn on FortiSandbox 4.4 alerts
| Vulnerability | Severity | Affected versions |
|---|---|---|
| Fortinet: Improper access control and session management in the web management interface FG-IR-26-185 · October 13, 2026 | Critical 9.6 | from 4.4.0 to 4.4.9; all versions 4.4 Fixed in 4.4.10 |
| Fortinet: Fabric API Authentication bypass FG-IR-26-179 · October 13, 2026 | Medium 4.9 | all versions 4.4 |
| Fortinet: Persistent Denial of Service in Admin Profile FG-IR-26-176 · October 13, 2026 | Medium 4.8 | all versions 4.4 |
| Fortinet: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information FG-IR-26-166 · September 8, 2026 | Critical 9.9 | from 4.4.0 to 4.4.8 Fixed in 4.4.9 |
| Fortinet: Cron Job Injection in Remote Backup FG-IR-26-167 · September 8, 2026 | Medium 6.7 | from 4.4.0 to 4.4.9 Fixed in 4.4.10 |
| Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-25089 · July 16, 2026 | Critical 9.8 Exploited | from 4.4.0 to 4.4.8 |
| Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-39808 · July 16, 2026 | Critical 9.8 Exploited | from 4.4.0 to 4.4.8 |
| Fortinet: Unauthenticated VNC access exposed on all interfaces FG-IR-26-145 · July 14, 2026 | High 8.6 | from 4.4.3 to 4.4.8 Fixed in 4.4.9 |
| Fortinet: Second-Order OS Command Injection via JSON Input on start vnc feature FG-IR-26-141 · June 9, 2026 | Critical 9.8 | from 4.4.0 to 4.4.8 Fixed in 4.4.9 |
Affected versions are compiled automatically from vendor advisories and NVD and may contain errors. Where no fixed version is shown, you will find it in the official advisory linked from every page: check it there before updating.