CVE-2026-25089, CoreCVE

Back Back to CVE browser

CRITICAL KEV

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Published Jun 9, 2026 ·Due Jul 19, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 76.11%

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Affected products

Vendor Fortinet Product FortiSandbox Default
unaffected
- Version
  4.2.1
  Status
  affected
  Constraints
  <=4.2.8
- Version
  4.4.0
  Status
  affected
  Constraints
  <=4.4.8
- Version
  5.0.0
  Status
  affected
  Constraints
  <=5.0.5
Vendor Fortinet Product FortiSandbox Cloud Default
unaffected
- Version
  5.0.4
  Status
  affected
  Constraints
  <=5.0.5
Vendor Fortinet Product FortiSandbox PaaS Default
unaffected
- Version
  5.0.4
  Status
  affected
  Constraints
  <=5.0.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

FortiSandbox

unaffected

Version	Status	Constraints
4.2.1	affected	<=4.2.8
4.4.0	affected	<=4.4.8
5.0.0	affected	<=5.0.5

Fortinet

FortiSandbox Cloud

unaffected

Version	Status	Constraints
5.0.4	affected	<=5.0.5

Fortinet

FortiSandbox PaaS

unaffected

Version	Status	Constraints
5.0.4	affected	<=5.0.5

Remediation

Vendor solution

Upgrade to upcoming FortiSandbox version 5.2.0 or above Upgrade to FortiSandbox version 5.0.6 or above Upgrade to FortiSandbox version 4.4.9 or above Upgrade to upcoming FortiSandbox PaaS version 5.2.0 or above Upgrade to FortiSandbox PaaS version 5.0.6 or above Fortinet remediated this issue in FortiSandbox Cloud version 5.2.0 (not released) and hence customers do not need to perform any action. Fortinet remediated this issue in FortiSandbox Cloud version 5.0.6 (not released) and hence customers do not need to perform any action.

Metrics

76.11% 0.76112

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.76112

Score over time

Jun–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	76.11% (0.76112)	99.52th	v5 (v2026.06.15)
Aug 24, 2026	76.11% (0.76112)	99.49th	v5 (v2026.06.15)
Aug 6, 2026	73.60% (0.73603)	99.42th	v5 (v2026.06.15)
Jul 24, 2026	69.83% (0.69827)	99.30th	v5 (v2026.06.15)
Jul 17, 2026	36.13% (0.36135)	98.30th	v5 (v2026.06.15)
Jun 23, 2026	23.39% (0.23393)	97.49th	v5 (v2026.06.15)
Jun 15, 2026	2.66% (0.02660)	83.67th	v5 (v2026.06.15)
Jun 12, 2026	0.90% (0.00898)	76.17th	v4 (v2025.03.14)
Jun 10, 2026	2.03% (0.02027)	84.15th	v4 (v2025.03.14)

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://fortiguard.fortinet.com/psirt/FG-IR-26-141
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089
government-resourceUS Government Resource

Link	Providers	Tags
https://fortiguard.fortinet.com/psirt/FG-IR-26-141		Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089		government-resourceUS Government Resource