Vulnerabilities

An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password

A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via

CVE-2026-25089 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox caused by improper neutralization of special elements in OS commands, allowing an unauthenticated attacker to execute unauthorized commands by sending specifically crafted HTTP requests to the product. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 score of 9.8), meaning any reachable instance — hardware/VM appliance, FortiSandbox Cloud, or FortiSandbox PaaS — is exposed to system-level command execution. Successful exploitation carries high impact to confidentiality, integrity, and availability on the sandbox itself and can serve as a foothold into the surrounding network. Organizations running FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, or 4.2 (all versions), as well as FortiSandbox Cloud 5.0.4–5.0.5 and FortiSandbox PaaS 5.0.4–5.0.5, are affected. The vulnerability is being actively exploited in the wild: CISA added it to the KEV catalog on 2026-07-16, EPSS assigns a 76.1% probability of exploitation within 30 days (100th percentile), and news coverage describes FortiSandbox bugs under active attack, though no public proof-of-concept is known.

Do: Upgrade FortiSandbox to a release beyond the affected ranges — newer than 5.0.5, 4.4.8, and 4.2 — and update FortiSandbox Cloud and PaaS beyond 5.0.5, following Fortinet's PSIRT advisory for the exact fixed versions (not specified in this data). Until patched, restrict the FortiSandbox management interface from direct internet exposure and review appliance logs for signs of command-injection exploitation. Organizations subject to CISA's KEV requirements must apply vendor mitigations per BOD 26-04 timelines or discontinue cloud use of the product if mitigations are unavailable.

CVE-2026-39808 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox versions 4.4.0 through 4.4.8, caused by improper neutralization of special elements passed to OS commands. The vulnerability is network-reachable, requires no privileges or user interaction (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), though CISA's description does not specify the exact entry point that a remote unauthenticated attacker abuses to trigger it. Successful exploitation lets the attacker execute unauthorized code or commands on the appliance, with high impact to confidentiality, integrity, and availability. Any organization running FortiSandbox 4.4.0-4.4.8 is affected; these sandboxing appliances are typically deployed as add-ons to enterprise FortiGate security estates. The flaw was added to CISA's KEV on 2026-07-16, and press coverage describes critical FortiSandbox bugs coming under active attack, so in-the-wild exploitation should be assumed.

Do: Upgrade all FortiSandbox appliances out of the affected 4.4.0-4.4.8 range to a fixed release per Fortinet's advisory, prioritizing internet-exposed units and complying with the CISA KEV required action (added 2026-07-16) and BOD 26-04 guidance. Until patched, restrict network access to the appliance's management and analysis interfaces and triage for signs of command execution such as unexpected processes or outbound connections. Confirm the specific fixed 4.4.x build in Fortinet's PSIRT advisory before scheduling upgrades.

CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.

Do: Upgrade FortiOS, FortiSwitchManager, and FortiSASE in accordance with Fortinet's advisory (specific fixed versions are not listed in the available data), prioritizing internet-exposed FortiGate firewalls per CISA KEV and BOD 26-04 timelines. Hunt for signs of compromise, including custom Node.js malware and the PivotC2 RAT, on FortiGate devices, and review exposure and access logs for admin/SSL-VPN interfaces. If patching is not possible, apply vendor-recommended mitigations or, per BOD 26-04, discontinue use of the exposed product.