CVE-2024-27781: High Cross-Site Scripting in FortiSandbox

CVE-2024-27781 is a high severity (CVSS 7.1 in NVD) cross-site scripting flaw in the FortiSandbox web interface. An authenticated attacker can send crafted HTTP requests to run unauthorised code or commands. Upgrade to 4.4.5, 4.2.7 or 4.0.5 or later, or migrate if you run 3.x.

What's affected

Per Fortinet advisory FG-IR-24-063, published February 11, 2025 and updated May 7, 2025:

• FortiSandbox 5.0: not affected.
• 4.4.0 through 4.4.4: upgrade to 4.4.5 or above.
• 4.2.1 through 4.2.6: upgrade to 4.2.7 or above.
• 4.0.0 through 4.0.4: upgrade to 4.0.5 or above.
• 3.2, 3.1 and 3.0: all versions affected. Migrate to a fixed release.

Fortinet says it remediated the issue in FortiSandbox Cloud version 24.1 in the third quarter of 2024, so cloud customers need not act. The advisory labels its own severity Medium, while NVD scores it 7.1 High. The issue was found internally and is marked as not known to be exploited.

How to check if you're exposed

Fortinet products show their firmware version on the dashboard or in the command line. On the CLI, the status command prints it:

get system status

Compare the reported version with the affected and fixed versions above. If your branch is listed as migrate to a fixed release, there is no patch on that branch and you need to move to a supported one.

What to do now

1. Upgrade FortiSandbox to the fixed release for your branch, or migrate if you are on 3.x.
2. Limit who has accounts on the web interface and remove unused ones.
3. Keep the management interface on an admin network.
4. Require administrators to use a dedicated browser profile for the appliance, with no other tabs open.
5. Review recent configuration changes and account activity after patching.

Why it matters

The class is CWE-79, cross-site scripting. The page sends user-controlled text back to a browser without neutralising it, so the browser treats it as script. In an admin console that script runs with the admin's rights.

This one needs an authenticated attacker and user interaction, which is why the score sits at 7.1. The danger is a lower-privileged user, or someone who has stolen an account, going after a more privileged administrator. A sandbox appliance sees suspicious files and verdicts, so its console is not a place to leave open to casual access.

Try it yourself

Fixes like this arrive across many products at once. This demo shows how a vulnerability management view helps you sequence the work.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Fortinet PSIRT advisory FG-IR-24-063

Last reviewed: 19 October 2026.