CVE-2026-25089
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
CISA Known Exploited Vulnerability
Vendor / Product
Fortinet — FortiSandbox
Date Added
2026-07-16
Remediation Due
2026-07-19
https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-25089
Weakness Classification (1)
Affected Software (5)
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortisandbox | 4.2.0 – 4.2.8 |
| fortinet | fortisandbox | 4.4.0 – 4.4.9 |
| fortinet | fortisandbox | 5.0.0 – 5.0.6 |
| fortinet | fortisandbox_cloud | 5.0.4 – 5.0.6 |
| fortinet | fortisandbox_paas | 5.0.4 – 5.0.6 |
References & Advisories (2)
Vendor Advisory
US Government Resource