Is CVE-2025-53679 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-53679 being exploited in the wild.

How severe is CVE-2025-53679?

High severity, with a CVSS score of 7.2, published 9 December 2025.

Which products and versions are affected?

Fortinet FortiSandbox 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, 4.0 all versions; Fortinet Fortisandbox Cloud 24.1, 23 all versions.

Is there a fix for CVE-2025-53679?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-53679 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-53679?

Check whether you run Fortinet FortiSandbox or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-53679: Fortinet FortiSandbox OS command injection in GUI backup options

CVE-2025-53679 · Severity: high · CVSS 7.2 · Published 2025-12-09

FortiSandbox is a security appliance used to identify and isolate advanced threats by executing suspicious files in a safe environment. A vulnerability in its management interface allows an administrator with high-level privileges to execute unauthorized commands on the underlying system. This could lead to a complete takeover of the appliance, potentially compromising the integrity of the threat analysis process.

Technologies: Fortinet FortiSandbox, Fortinet Fortisandbox Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2025-53679 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-53679 being exploited in the wild.
How severe is CVE-2025-53679?: High severity, with a CVSS score of 7.2, published 9 December 2025.
Which products and versions are affected?: Fortinet FortiSandbox 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, 4.0 all versions; Fortinet Fortisandbox Cloud 24.1, 23 all versions.
Is there a fix for CVE-2025-53679?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-53679 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-53679?: Check whether you run Fortinet FortiSandbox or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the FortiSandbox GUI, specifically within the backup options component. The flaw stems from improper neutralization of special elements in user-supplied input before it is passed to a system shell. A remote attacker with high privileges (PR:H) can exploit this by sending specially crafted HTTP or HTTPS requests to the management interface. Successful exploitation allows for arbitrary code execution with the privileges of the web server or underlying system. Fortinet has released patches in versions 5.0.3 and 4.4.8 to address this issue.

Affected products

Fortinet FortiSandbox 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, 4.0 all versions
Fortinet FortiSandbox Cloud 24.1, 23 all versions

Timeline

2025-12-09: disclosed: Initial publication by Fortinet
2025-12-09: advisory

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-454

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.