CVE-2026-25089: Fortinet FortiSandbox unauthenticated OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with CVSS 9.8, confirmed KEV exploitation and a very high EPSS score makes this an urgent patch-first issue.

What it is

FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS fail to neutralize special elements in HTTP request handling, allowing OS command injection (CWE-78). The flaw is remotely reachable without authentication and carries a CVSS 3.1 base score of 9.8, so any exposed instance is a high-value target.

Impact

An unauthenticated attacker can execute arbitrary commands on the appliance, giving full control of the affected system and its data.

Attack surface

Reached over the network via specifically crafted HTTP requests to the FortiSandbox web interface; the CVSS vector shows no privileges and no user interaction required.

Exploitation

CVE-2026-25089 was added to CISA KEV on 2026-07-16 with a 2026-07-19 remediation due date, and EPSS gives a 30-day exploitation probability of 0.76112 (99.5th percentile), indicating active exploitation. No ransomware campaign use is documented.

What to do

• Apply the Fortinet PSIRT FG-IR-26-141 fix for FortiSandbox 5.0.x, 4.4.x, 4.2 and the Cloud/PaaS 5.0.4-5.0.5 deployments as directed by the vendor advisory.
• If a patch is not yet available for a given deployment, follow CISA BOD 26-04 guidance and discontinue use of the product or isolate it from untrusted networks.
• Remove internet exposure of FortiSandbox management and scanning interfaces; restrict access to trusted management networks only.
• Audit all FortiSandbox instances for signs of compromise before and after patching, given confirmed exploitation.
• Track the CISA KEV due date of 2026-07-19 and confirm remediation completion for every affected asset.

Detection

• Review FortiSandbox HTTP access and application logs for crafted requests containing shell metacharacters or command separators.
• Monitor for unexpected child processes spawned by the web service (for example shell, curl, wget or netcat) on FortiSandbox hosts.
• Alert on outbound network connections from FortiSandbox appliances to unfamiliar external hosts.
• Hunt for new or modified files, cron entries or accounts on FortiSandbox systems that do not match baseline configuration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.