CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability
Description
CVE-2026-25089 is a critical OS command injection vulnerability in Fortinet FortiSandbox that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Rated CVSS 9.8 (Critical), the flaw affects FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, all 4.2 versions, as well as FortiSandbox Cloud and FortiSandbox PaaS 5.0.4 through 5.0.5. Because FortiSandbox is a security appliance that analyzes suspicious files, full command execution on it hands an attacker a privileged foothold inside the security infrastructure. CISA has added CVE-2026-25089 to its Known Exploited Vulnerabilities (KEV) catalog with a due date of 2026-07-19, and its EPSS score of 36.1% (98th percentile) signals a substantial likelihood of ongoing exploitation — affected Fortinet deployments should be patched immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortisandbox | >= 4.2.0, <= 4.2.8; >= 4.4.0, < 4.4.9; >= 5.0.0, < 5.0.6 |
| fortinet | fortisandbox cloud | >= 5.0.4, < 5.0.6 |
| fortinet | fortisandbox paas | >= 5.0.4, < 5.0.6 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-141(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when software builds an operating system command from externally influenced input without correctly neutralizing special elements such as shell metacharacters. In FortiSandbox, crafted HTTP requests reach code paths that construct OS commands, allowing an unauthenticated remote attacker to inject and execute arbitrary commands on the underlying appliance operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2026-25089 carries a CVSS 3.1 base score of 9.8 (Critical) because it combines every factor that makes a vulnerability dangerous: it is remotely exploitable without physical access over HTTP, easy to exploit with no special conditions needed, requires no authentication, and needs no user action. Confidentiality (High): an attacker who executes commands on a FortiSandbox appliance can access analysis artifacts, configurations, and credentials processed by the device. Integrity (High): injected commands can alter the appliance's behavior — a particularly serious outcome for a malware-analysis sandbox, since attackers could tamper with or blind the very system meant to detect them. Availability (High): arbitrary command execution allows the attacker to disable the sandbox service outright. With CISA-confirmed active exploitation and an EPSS score of 36.1% placing this vulnerability in the top 2% of all CVEs by exploitation likelihood, exposed FortiSandbox management interfaces represent an urgent, real-world risk.
Exploit Maturity
CVE-2026-25089 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild; ransomware involvement is currently marked as Unknown. The EPSS score of 36.1% (98.3rd percentile) indicates a high likelihood of exploitation activity — this vulnerability ranks among the most likely to be exploited of all published CVEs. No public exploit code is linked in the available references, which comprise the Fortinet PSIRT advisory FG-IR-26-141 and the CISA KEV entry, but the combination of confirmed exploitation and unauthenticated remote command execution means affected FortiSandbox instances should be treated as act-now priorities.
Remediation
- Follow the CISA KEV required action: "Apply mitigations in accordance with vendor instructions", ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements — and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-19.
- Upgrade per the Fortinet advisory FG-IR-26-141: FortiSandbox 5.0.x to 5.0.6 or later, FortiSandbox 4.4.x to 4.4.9 or later; FortiSandbox 4.2 is affected in all versions and should be migrated to a fixed release train. FortiSandbox Cloud and PaaS 5.0.4–5.0.5 must likewise be moved to 5.0.6 or later.
- Until patched, restrict access to the FortiSandbox HTTP interface: limit management access to dedicated admin networks, block internet exposure, and apply strict firewall or WAF rules on the HTTP endpoints.
- Review appliance logs and HTTP access logs for anomalous or malformed requests, unexpected processes, and configuration changes, treating any findings as potential compromise given confirmed in-the-wild exploitation.
- As long-term hardening against command injection (CWE-78), vendor-independent best practice is to avoid shell invocation from application code and use parameterized APIs — for appliance operators, the practical equivalent is minimizing exposed management surface and keeping FortiSandbox firmware on currently supported, patched releases.
Technical Details
The flaw is an OS command injection (CWE-78): FortiSandbox constructs operating system commands using input that arrives in HTTP requests, without properly neutralizing special elements that can modify the intended command. Unlike general command injection, OS command injection specifically targets the system shell, so an attacker who can smuggle shell metacharacters into the vulnerable parameter can append or replace commands that then run with the privileges of the FortiSandbox process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects this directly: the attack is network-based (AV:N) via crafted HTTP requests, has low complexity (AC:L), requires no privileges (PR:N) or user interaction (UI:N), and yields high impact on confidentiality, integrity, and availability of the appliance. The scope is unchanged (S:U), meaning the rated impact is on the FortiSandbox system itself — though compromising a security appliance that inspects potentially malicious files positions the attacker deep inside the defensive stack.
Frequently Asked Questions
Is CVE-2026-25089 being actively exploited?
Yes. CVE-2026-25089 is in CISA's Known Exploited Vulnerabilities catalog, which confirms exploitation in the wild, with a federal remediation deadline of 2026-07-19. Its EPSS score of 36.1% places it in the 98th percentile, meaning it is among the CVEs most likely to see continued exploitation activity.
What products are affected by CVE-2026-25089?
Affected are Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, and all FortiSandbox 4.2 versions. FortiSandbox Cloud and FortiSandbox PaaS versions 5.0.4 through 5.0.5 are also affected; fixed releases are 5.0.6 and 4.4.9 or later.
How do I fix CVE-2026-25089?
Upgrade FortiSandbox according to Fortinet advisory FG-IR-26-141: 5.0.x deployments to 5.0.6 or later and 4.4.x deployments to 4.4.9 or later, while 4.2 installations should migrate to a fixed release train. Until then, restrict access to the FortiSandbox HTTP interface to trusted management networks and monitor logs for suspicious requests.
How severe is CVE-2026-25089?
CVE-2026-25089 is rated Critical with a CVSS 3.1 base score of 9.8, allowing unauthenticated remote command execution with high impact on confidentiality, integrity, and availability. Combined with confirmed active exploitation and an EPSS percentile of 98.3, it is one of the most urgent vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.