FortiSandbox SSRF Vulnerability Allow Attacker to proxy Internal Traffic via Crafted HTTP Requests

Cybersecuritynews •Guru Baran • January 13, 2026

Fortinet disclosed a Server-Side Request Forgery (SSRF) vulnerability in its FortiSandbox appliance on January 13, 2026, urging users to update amid risks of internal network proxied requests. Tracked as CVE-2025-67685 (FG-IR-25-783), the flaw resides in the GUI component and stems from CWE-918, enabling authenticated attackers to craft HTTP requests that proxy traffic to internal plaintext […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiSandbox SSRF Vulnerability Disclosed, Affects Internal Traffic Proxying Fortinet disclosed a Server-Side Request Forgery (SSRF) vulnerability in its FortiSandbox appliance on January 13, 2026. The vulnerability, tracked as CVE-2025-67685, allows authenticated attackers to craft HTTP requests that can proxy internal network traffic. Users are urged to update their systems to mitigate the risks associated with this flaw. 2 sources 26

Extracted Entities

FortiSandbox SSRF Vulnerability Allow Attacker to proxy Internal Traffic via Crafted HTTP Requests

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Platforms (1)

Vulnerabilities (1)