FortiSandbox XSS Vulnerability Let Attackers Run Arbitrary Commands

Fortinet disclosed a high-severity reflected XSS vulnerability (CVE-2025-52436, CVSS 7.9) in the FortiSandbox GUI that allows unauthenticated attackers to inject JavaScript — potentially leading to remote code execution and full command-line access; affected PaaS versions include 5.0, 4.4, 4.2, and 4.0 with patches available (e.g., 4.4.8 and 5.0.5) and Fortinet recommending immediate upgrades and access restrictions until systems are remediated.