Fortinet Fortinet FortiSandbox

Name: Fortinet Fortinet FortiSandbox
Brand: Fortinet

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

critical

by severity

0critical5high7medium0low

updated 2026-10-27

vulnerabilities (12)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-22125US	high7.2	1.41% (73rd)	—	no fix	2021-07-20	≤ FortiSandbox before 3.2.2
CVE-2021-26097US	high8.8	1.17% (67th)	—	no fix	2021-08-04	≤ FortiSandbox 3.2.2, 3.2.1, 3.2.0, 3.1.4, 3.1.3, 3.1.2, 3.1.1, 3.1.0, 3.0.6, 3.0.5, 3.0.4, 3.0.3, 3.0.2, 3.0.1, 3.0.0
CVE-2020-29011US	high8.8	0.98% (62nd)	—	no fix	2021-08-04	≤ FortiSandbox 3.2.2, 3.2.1, 3.2.0, 3.1.4, 3.1.3, 3.1.2, 3.1.1, 3.1.0
CVE-2021-32591US	medium5.3OT elevated	0.93% (60th)	—	no fix	2021-12-08	≤ FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier
CVE-2021-24010US	medium6.5	0.90% (60th)	—	no fix	2021-08-04	≤ FortiSandbox 3.2.2, 3.2.1, 3.2.0, 3.1.4, 3.1.3, 3.1.2, 3.1.1, 3.1.0
CVE-2021-26098US	high7.5OT elevated	0.81% (57th)	—	no fix	2021-08-04	≤ FortiSandbox before 4.0.0
CVE-2021-26096US	high8.8	0.77% (55th)	—	no fix	2021-08-04	≤ FortiSandbox before 4.0.0
CVE-2020-15939US	medium4.3	0.65% (51st)	—	no fix	2021-09-06	≤ FortiSandbox 3.2.1, 3.1.4
CVE-2020-29013US	medium5.4	0.64% (50th)	—	no fix	2022-04-06	≤ FortiSandbox before 3.2.2
CVE-2021-24014US	medium6.1	0.61% (49th)	—	no fix	2021-08-04	≤ FortiSandbox before 4.0.0
CVE-2020-29012US	medium5.3	0.55% (46th)	—	no fix	2021-09-08	≤ FortiSandbox 3.2.1,
CVE-2020-29014US	medium5.3	0.50% (43rd)	—	no fix	2021-07-09	≤ FortiSandbox before 3.2.2

The flaw types (CWEs) most of these CVEs share.

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-327Use of a Broken or Risky Cryptographic Algorithm1 CVEs
CWE-330Use of Insufficiently Random Values1 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1 CVEs
CWE-613Insufficient Session Expiration1 CVEs
CWE-787Out-of-bounds Write1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.