FortiSandbox SSRF Flaw: Attackers Proxy Vulnerability Allow

On January 13, 2026, Fortinet disclosed a Server-Side Request Forgery (SSRF) vulnerability affecting its FortiSandbox appliance. The company is urging users to update, citing risks of internal network proxied requests.

Tracked as CVE-2025-67685 (FG-IR-25-783), the flaw resides in the GUI component and stems from CWE-918, enabling authenticated attackers to craft HTTP requests that proxy traffic to internal plaintext endpoints only.

With a CVSSv3 score of 3.4 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N), Fortinet rates the issue as low severity, tied to improper access control.

Attackers need high-privilege access, limiting exploitation to insiders or compromised admin accounts. No evidence of active exploits exists as of publication, but the vulnerability could expose sensitive internal services in air-gapped or segmented environments.

FortiSandbox SSRF Vulnerability

The SSRF arises from inadequate input validation in the GUI console, allowing request forging to localhost or internal IPs over HTTP/HTTPS plaintext.

Fortinet emphasizes that restricting to non-TLS endpoints reduces the blast radius, but proxying can leak metadata or enable further pivots in misconfigured setups. Discovered by Jason McFadyen of Trend Micro’s Zero Day Initiative under responsible disclosure, the bug affects older versions of FortiSandbox.

No indicators of compromise (IOCs) were provided, but admins should audit GUI logs for anomalous internal fetches since January 2026.

Affected Versions and Remediation

Fortinet recommends immediate upgrades via the FortiGuard portal. Organizations running legacy FortiSandbox should prioritize migration, as end-of-support for FortiSandbox 4.x approaches.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.