Threat Investigation
Request a demo

CVE-2025-67685

Low

Description

A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.

SeverityLow
CVSS3.8
Exploit probability—
ProductFortinet Fortisandbox
PublishedJan 13, 2026
First seenJan 13, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update
  • fortinet fortisandbox5.0.5 or later

Affected products

ProductAffected versionsFixed in
fortinet fortisandbox4.0.0 ≤ v < 5.0.55.0.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.