CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2026-25089

CWE-78

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

CVSS Score
9.1
Critical
EPSS — Exploit Probability
70%
Riskier than 99% of all CVEs
Exploitation
Confirmed in the wild
KEV since 2026-07-16
Remediation
Patch available
Federal deadline 2026-07-19
NVD entry Vendor patch PoC / advisory CISA KEV

14 articles across 7 outlets · first covered Jun 10, 2026 · latest Jul 18, 2026

Tracked incidents

vulnerability open 33 articles
Oracle PeopleSoft zero‑day flaw CVE-2026-35273 exploited in higher education attacks

Coverage timeline