FortiSandbox SSRF Vulnerability Allow Attacker to proxy Internal Traffic via Crafted HTTP Requests

Fortinet disclosed a Server-Side Request Forgery (SSRF) vulnerability in its FortiSandbox appliance on January 13, 2026, urging users to update amid risks of internal network proxied requests.

Tracked as CVE-2025-67685 (FG-IR-25-783), the flaw resides in the GUI component and stems from CWE-918, enabling authenticated attackers to craft HTTP requests that proxy traffic to internal plaintext endpoints only.

With a CVSSv3 score of 3.4 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N), Fortinet rates the issue as low severity, tied to improper access control.

Attackers need high-privilege access, limiting exploitation to insiders or compromised admin accounts. No evidence of active exploits exists as of publication, but the vulnerability could expose sensitive internal services in air-gapped or segmented environments.

FortiSandbox SSRF Vulnerability

The SSRF arises from inadequate input validation in the GUI console, allowing request forging to localhost or internal IPs over HTTP/HTTPS plaintext.

Fortinet emphasizes that restricting to non-TLS endpoints reduces the blast radius, but proxying can leak metadata or enable further pivots in misconfigured setups. Discovered by Jason McFadyen of Trend Micro’s Zero Day Initiative under responsible disclosure, the bug affects older versions of FortiSandbox.

No indicators of compromise (IOCs) were provided, but admins should audit GUI logs for anomalous internal fetches since January 2026.

Affected Versions and Remediation

Fortinet recommends immediate upgrades via the FortiGuard portal. Organizations running legacy FortiSandbox should prioritize migration, as end-of-support for FortiSandbox 4.x approaches.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.