In CISA KEV9.1 CriticalCWE-78
CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability
FortinetFortiSandbox
Status
- Exploited in the wild
- In CISA KEV since 16 Jul
- Vendor fix available
Federal deadlineSun 19 Jul, 23:59 UTC
Passed 97 days ago
CISA KEV · added 16 Jul
Exploit probabilityEPSSchecked 24 Oct
76%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage 13 articles · 6 outlets
See the full timelineShow as table
- CISA urges patch of FortiSandbox, SharePoint flaws amid exploitsSecurity Affairs
- CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet VulnerabilitiesInfosecurity · mentions it in passing
- 292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows UsersSecurityOnline · mentions it in passing
- Red Hat OpenShift AI flaw lets attackers read local filesSecurityOnline · mentions it in passing
- CISA orders urgent patches for SharePoint, FortiSandbox flawsSecurityOnline · mentions it in passing
- CISA KEV Catalogue Adds FortiSandbox Flaw CVE-2026-25089CISA · official notice
- FortiSandbox Flaw Lets Hackers Run Code, CISA WarnsCISA · official notice
- FortiSandbox CVE-2026-39813 lets hackers bypass auth, run codeSOCRadar · mentions it in passing
- 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker CrosshairsSecurityWeek · mentions it in passing
- Fortinet warns of active exploits in unpatched FortiSandbox flawsSecurity Affairs · mentions it in passing
- Fortinet patches CVE-2026-25089 in FortiSandbox command injectionSecurity Affairs
- Critical Vulnerabilities Patched in Fortinet, Ivanti ProductsSecurityWeek
- FortiSandbox flaw CVE-2026-25089 lets attackers run commandsSecurityOnline · first in our coverage