This vulnerability affects multiple versions of Fortinet FortiSandbox and FortiSandbox Cloud products, including FortiSandbox PaaS versions 21.3 through 23.4 and FortiSandbox versions 4.4.0 through 5.0.5. Due to a missing authorization mechanism, an unauthenticated attacker can send crafted HTTP requests to execute arbitrary code or commands on the affected system. The vulnerability is rated critical with a CVSS 3.1 score of 9.1, reflecting network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. Fortinet has released an official fix to address this issue.

Successful exploitation allows unauthenticated attackers to execute arbitrary code or commands on vulnerable FortiSandbox systems, potentially leading to full system compromise. This impacts confidentiality, integrity, and availability of the affected systems. No known exploits in the wild have been reported at the time of publication.

An official fix is available from Fortinet to remediate this vulnerability. Users should apply the vendor-provided patches promptly to affected FortiSandbox and FortiSandbox Cloud versions. Since this is not a cloud-hosted service vulnerability, remediation requires customer action to update their installations. No additional mitigation steps are indicated by the vendor advisory.