CVE-2025-67685: SSRF in FortiSandbox 4.0 - 5.0.4

The SSRF vulnerability in FortiSandbox allows an authenticated attacker to craft HTTP requests that the FortiSandbox system will execute on behalf of the attacker. While the vulnerability is limited to plaintext endpoints, this can still be exploited to access internal resources that are not directly exposed to the internet. An attacker could potentially enumerate internal services, access sensitive data stored in plaintext, or even interact with internal APIs. The impact is amplified if the FortiSandbox system has access to highly sensitive internal networks or systems, as it could be used as a pivot point for further attacks. While the plaintext restriction limits the scope, it still presents a significant risk, particularly in environments with misconfigured internal services.

1. Reserved2025-12-10
2. Published2026-01-13
3. Modified2026-01-14
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67685 is to upgrade FortiSandbox to version 5.0.5 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the FortiSandbox system to only authorized users and systems. Implement strict firewall rules to limit outbound traffic from the FortiSandbox system to only necessary destinations. Review and harden any internal services that could be accessed via the SSRF vulnerability, ensuring they are not exposed to unnecessary traffic. Consider deploying a Web Application Firewall (WAF) or reverse proxy in front of FortiSandbox to filter HTTP requests and block malicious traffic. After upgrading, confirm the vulnerability is resolved by attempting to trigger the SSRF request and verifying it is blocked.