Cyber Posture

CVE-2025-52436

High

Published: 10 February 2026

Published
10 February 2026
Modified
18 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0031 54.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52436 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Fortinet Fortisandbox. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match
prevent

Directly mitigates XSS by filtering information outputs to neutralize malicious scripts from crafted requests during web page generation.

SI-10 Information Input Validation good match
prevent

Prevents exploitation by validating all information inputs from unauthenticated crafted requests to block improper neutralization.

SI-2 Flaw Remediation good match
prevent

Remediates the specific XSS flaw in vulnerable FortiSandbox versions through identification, testing, and timely patching.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a network-accessible (AV:N), unauthenticated (PR:N) XSS in a web management interface (FortiSandbox), directly enabling exploitation of a public-facing application to execute commands via crafted requests requiring user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands…

more

via crafted requests.

Deeper analysisAI

CVE-2025-52436 is an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability (CWE-79) in Fortinet FortiSandbox. The affected versions include FortiSandbox 5.0.0 through 5.0.1, 4.4.0 through 4.4.7, 4.2 all versions, and 4.0 all versions. Published on 2026-02-10, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

An unauthenticated attacker can exploit the vulnerability via crafted requests, which requires user interaction. Successful exploitation may allow the attacker to execute commands, leading to high impacts on confidentiality, integrity, and availability.

Mitigation details are available in the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-093.

Details

CWE(s)
CWE-79

Affected Products

fortinet
fortisandbox
4.0.0 — 4.4.8 · 5.0.0 — 5.0.2

CVEs Like This One

CVE-2024-27781Same product: Fortinet Fortisandbox
CVE-2026-39813Same product: Fortinet Fortisandbox
CVE-2024-52961Same product: Fortinet Fortisandbox
CVE-2026-39808Same product: Fortinet Fortisandbox
CVE-2024-52960Same product: Fortinet Fortisandbox
CVE-2024-27778Same product: Fortinet Fortisandbox
CVE-2024-54018Same product: Fortinet Fortisandbox
CVE-2024-54027Same product: Fortinet Fortisandbox
CVE-2024-54026Same product: Fortinet Fortisandbox
CVE-2024-45328Same product: Fortinet Fortisandbox

References