60
CVE-2026-25089
KEVlargeUnauthenticated OS Command Injection RCE in Fortinet FortiSandbox
CISA: Fortinet FortiSandbox OS Command Injection Vulnerability
CVSS 3.1
9.8 critical
EPSS
76%p100
Published
()
KEV added
AI analysis
CVE-2026-25089 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox caused by improper neutralization of special elements in OS commands, allowing an unauthenticated attacker to execute unauthorized commands by sending specifically crafted HTTP requests to the product. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 score of 9.8), meaning any reachable instance — hardware/VM appliance, FortiSandbox Cloud, or FortiSandbox PaaS — is exposed to system-level command execution. Successful exploitation carries high impact to confidentiality, integrity, and availability on the sandbox itself and can serve as a foothold into the surrounding network. Organizations running FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, or 4.2 (all versions), as well as FortiSandbox Cloud 5.0.4–5.0.5 and FortiSandbox PaaS 5.0.4–5.0.5, are affected. The vulnerability is being actively exploited in the wild: CISA added it to the KEV catalog on 2026-07-16, EPSS assigns a 76.1% probability of exploitation within 30 days (100th percentile), and news coverage describes FortiSandbox bugs under active attack, though no public proof-of-concept is known.
What to do: Upgrade FortiSandbox to a release beyond the affected ranges — newer than 5.0.5, 4.4.8, and 4.2 — and update FortiSandbox Cloud and PaaS beyond 5.0.5, following Fortinet's PSIRT advisory for the exact fixed versions (not specified in this data). Until patched, restrict the FortiSandbox management interface from direct internet exposure and review appliance logs for signs of command-injection exploitation. Organizations subject to CISA's KEV requirements must apply vendor mitigations per BOD 26-04 timelines or discontinue cloud use of the product if mitigations are unavailable.
Affected
| Fortinet FortiSandbox | 5.0.0 through 5.0.5 |
| Fortinet FortiSandbox | 4.4.0 through 4.4.8 |
| Fortinet FortiSandbox | 4.2 (all versions) |
| Fortinet FortiSandbox Cloud | 5.0.4 through 5.0.5 |
| Fortinet FortiSandbox PaaS | 5.0.4 through 5.0.5 |
Estimated exposure
largelikely tens of thousands of deployments worldwide (10k–100k systems across appliance, VM, Cloud, and PaaS), with only a subset internet-exposed; exact install… — FortiSandbox is an enterprise advanced threat protection product sold in appliance, VM, cloud, and PaaS form factors by a top-tier network security vendor, so a deployment base in the tens of thousands is a reasonable order-of-magnitude…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests
CISA Known Exploited Vulnerability
- Affected
- Fortinet FortiSandbox
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- fortinet
- Products
- fortisandbox, fortisandbox cloud, fortisandbox paas
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news13 stories
60
60
60
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026
60
June 2026 CVE Landscape
60
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week
60
60
Fortinet Warned as Three Critical FortiSandbox Bugs Come Under Attack
60
60
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
60
60