Is CVE-2026-25836 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25836 being exploited in the wild.

How severe is CVE-2026-25836?

High severity, with a CVSS score of 7.2, published 10 March 2026.

Which products and versions are affected?

Fortinet FortiSandbox PaaS 5.0.4.

Is there a fix for CVE-2026-25836?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-25836 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-25836?

Check whether you run Fortinet FortiSandbox PaaS or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25836: Fortinet FortiSandbox Cloud OS command injection in Web UI

CVE-2026-25836 · Severity: high · CVSS 7.2 · Published 2026-03-10

Fortinet FortiSandbox Cloud and PaaS are security solutions used to analyze suspicious files in a safe, isolated environment to detect malware. A vulnerability in the management interface could allow a highly privileged administrator to execute unauthorized system commands. While this requires existing administrative access, an exploit could allow an attacker to bypass intended security restrictions and gain deeper control over the sandbox infrastructure.

Technologies: Fortinet FortiSandbox PaaS, Fortinet Fortisandbox Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-25836 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25836 being exploited in the wild.
How severe is CVE-2026-25836?: High severity, with a CVSS score of 7.2, published 10 March 2026.
Which products and versions are affected?: Fortinet FortiSandbox PaaS 5.0.4.
Is there a fix for CVE-2026-25836?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-25836 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-25836?: Check whether you run Fortinet FortiSandbox PaaS or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the 'vmimages update' feature of the FortiSandbox Cloud and PaaS Web UI. The flaw is caused by improper neutralization of special elements within HTTP requests processed by the management interface. A remote attacker with super-admin privileges and CLI access can exploit this by sending specially crafted HTTP requests to execute arbitrary code or commands on the underlying operating system. The vulnerability is fixed in version 5.0.5 and above. Although the vendor's internal advisory lists a CVSS of 6.7, the NVD record reflects a CVSS 3.1 score of 7.2.

Affected products

Fortinet FortiSandbox Cloud 5.0.4
Fortinet FortiSandbox PaaS 5.0.4

Timeline

2026-03-10: disclosed: Initial publication by Fortinet
2026-03-10: advisory: NVD entry created
2026-03-26: other: Advisory updated to include FortiSandbox PaaS

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-096

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.