CVE-2026-25089

CRITICALCVSS 9.876% EPSSKEV — known exploited🧨 Public exploit (GreyNoise)

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Published 2026-06-09 · last modified 2026-07-23

Affected products

VendorProduct
fortinetfortisandbox
fortinetfortisandbox_cloud
fortinetfortisandbox_paas

Full record at NVD ↗

← Get alerted the moment a CVE hits your gear — subscribe free

Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.