CVE entry · CVE-2026-25089
CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
- Actively exploited: added to CISA’s KEV catalog on July 16, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: July 19, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Fortinet FortiSandbox, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (fortiguard.fortinet.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Fortinet vulnerabilities
-
Fortinet Multiple Products Path Traversal Vulnerability
-
Fortinet FortiMail Path Traversal Vulnerability
-
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
-
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
-
Fortinet FortiSandbox OS Command Injection Vulnerability
-
Fortinet FortiClient EMS SQL Injection Vulnerability