CVE-2026-25089: Fortinet FortiSandbox OS command injection in Web UI

CVE-2026-25089 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-06-09

FortiSandbox is a security solution used to identify and analyze advanced threats by executing suspicious files in a safe, isolated environment. A critical vulnerability has been identified that allows an unauthorized person to take control of the system by sending specially crafted web requests. If exploited, an attacker could disrupt security operations, access sensitive analysis data, or use the compromised system as a foothold to attack other parts of the corporate network.

Technologies: Fortinet FortiSandbox, Fortinet FortiSandbox PaaS, Fortinet Fortisandbox Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-25089 exploited in the wild?
Yes. CVE-2026-25089 is known to be exploited in the wild, first recorded on 16 July 2026. Treat it as urgent.
How severe is CVE-2026-25089?
Critical severity, with a CVSS score of 9.8, published 9 June 2026.
Which products and versions are affected?
Fortinet FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, 4.2 all versions; Fortinet FortiSandbox PaaS 5.0.4 through 5.0.5; Fortinet Fortisandbox Cloud 5.0.4 through 5.0.5.
Is there a fix for CVE-2026-25089?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-25089 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25089?
Check whether you run Fortinet FortiSandbox, Fortinet FortiSandbox PaaS or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in Fortinet FortiSandbox due to the improper neutralization of special elements in HTTP requests. The flaw resides in the handling of specific HTTP inputs, allowing a remote, unauthenticated attacker to inject and execute arbitrary operating system commands. The attack vector is network-based with low complexity and requires no user interaction or prior authentication. Successful exploitation results in a full compromise of the affected appliance or cloud instance (Total Impact). The vulnerability affects FortiSandbox versions 5.0.0-5.0.5, 4.4.0-4.4.8, and all 4.2 versions, as well as specific Cloud and PaaS versions. Users are advised to refer to Fortinet advisory FG-IR-26-141 for patching information.

Affected products

  • Fortinet FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, 4.2 all versions
  • Fortinet FortiSandbox Cloud 5.0.4 through 5.0.5
  • Fortinet FortiSandbox PaaS 5.0.4 through 5.0.5

Timeline

  • 2026-06-09: disclosed: NVD Published Date
  • 2026-07-16: advisory: Date provided in advisory text

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.