FortiSandbox-VM-USG
Appliance
· FortiSandbox Series
Is the FortiSandbox-VM-USG still supported?
No. Fortinet ended support for the FortiSandbox-VM-USG on 2022-09-26. No further security fixes will be issued. See Fortinet's lifecycle bulletin.
When does the FortiSandbox-VM-USG reach end of support?
Fortinet support for the FortiSandbox-VM-USG ends on 2022-09-26.
What replaces the FortiSandbox-VM-USG?
Fortinet has not published a successor model for the FortiSandbox-VM-USG.
What known-exploited CVEs apply to the FortiSandbox-VM-USG past end of support?
2 CVEs in CISA's Known Exploited Vulnerabilities catalog apply to the platform the FortiSandbox-VM-USG runs. These will not be patched on this device because it is past the Fortinet security-support date. See the Known Exploited Vulnerabilities table below for the full list.
Known Exploited Vulnerabilities
This device is past Fortinet's security-support date. 2 CVEs in CISA's Known Exploited Vulnerabilities catalog apply to the platform it runs. Fortinet is not issuing patches for this model. Isolate, compensate, or refresh.
| CVE | KEV added | Vulnerability | Flags |
|---|---|---|---|
CVE-2026-25089
|
Fortinet FortiSandbox OS Command Injection Vulnerability | ||
CVE-2026-39808
|
Fortinet FortiSandbox OS Command Injection Vulnerability |
Source: CISA Known Exploited Vulnerabilities catalog. The Ransomware flag reflects CISA's own knownRansomwareCampaignUse field, set when the CVE has been observed in ransomware campaigns per their threat intel. It's not a property of the vulnerability description itself.
Correlation is at the platform level, not per-OS-version. Not exhaustive: KEV only lists actively-exploited CVEs and many relevant unexploited vulnerabilities are not here. Verify against vendor security advisories (PSIRT, JSA, PAN-SA) and NVD before acting. See compensating controls if refresh isn't immediate.
FortiSandbox-VM-USG Lifecycle Overview
The Fortinet FortiSandbox-VM-USG is a appliance product in the Fortinet FortiSandbox series. This product has reached end of life as of , meaning Fortinet no longer provides technical support, software updates, or hardware replacement for this product. It was last available for purchase on . Organizations still running the FortiSandbox-VM-USG should plan a migration .
Lifecycle Milestones
| End of sale | 8y 10mo ago | |
|---|---|---|
| End of software maintenance | 4y 10mo ago | |
| Last date of support | 3y 10mo ago |