Vulnerability-Lookup

CVE-2026-25089 (GCVE-0-2026-25089)

Vulnerability from cvelistv5 – Published: 2026-06-09 14:27 – Updated: 2026-07-17 03:56

CISA Previdian

Summary

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 00:00 UTC

CWE

CWE-78 - Execute unauthorized code or commands

Assigner

fortinet mitre root

References

2 references

URL	Tags
https://fortiguard.fortinet.com/psirt/FG-IR-26-141
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

3 products

Vendor	Product	Version
Fortinet	FortiSandbox	Affected: 5.0.0 , ≤ 5.0.5 (semver) Affected: 4.4.0 , ≤ 4.4.8 (semver) Affected: 4.2.1 , ≤ 4.2.8 (semver) cpe:2.3:a:fortinet:fortisandbox:5.0.5:::::::* cpe:2.3:a:fortinet:fortisandbox:5.0.4:::::::* cpe:2.3:a:fortinet:fortisandbox:5.0.3:::::::* cpe:2.3:a:fortinet:fortisandbox:5.0.2:::::::* cpe:2.3:a:fortinet:fortisandbox:5.0.1:::::::* cpe:2.3:a:fortinet:fortisandbox:5.0.0:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.8:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.7:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.6:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.5:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.4:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.3:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.2:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.1:::::::* cpe:2.3:a:fortinet:fortisandbox:4.4.0:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.8:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.7:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.6:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.5:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.4:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.3:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.2:::::::* cpe:2.3:a:fortinet:fortisandbox:4.2.1:::::::*
Fortinet	FortiSandbox Cloud	Affected: 5.0.4 , ≤ 5.0.5 (semver) cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:::::::* cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:::::::*
Fortinet	FortiSandbox PaaS	Affected: 5.0.4 , ≤ 5.0.5 (semver) cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:::::::* cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:::::::*

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: b832cbb7-a155-45e7-82ec-56c92cba639a

Vulnerability ID: CVE-2026-25089

Status: Confirmed

Status Updated: 2026-07-16 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-07-16

Asserted: 2026-07-16

Scope

Notes: Fortinet FortiSandbox OS Command Injection Vulnerability | Affected: Fortinet / FortiSandbox | Description: Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-07-19 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-25089

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-78
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	FortiSandbox
Due Date	2026-07-19
Date Added	2026-07-16
Vendorproject	Fortinet
Vulnerabilityname	Fortinet FortiSandbox OS Command Injection Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-25089

Created: 2026-07-16 18:00 UTC | Updated: 2026-07-16 18:00 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: d39fc083-8f7b-4775-973e-4b573c0eb3a8

Vulnerability ID: CVE-2026-25089

Status: Confirmed

Status Updated: 2026-07-16 17:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-07-16

Asserted: 2026-07-16

Scope

Notes: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through... | Affected: Fortinet / FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS | CVSS: 9.8 (CRITICAL) | EPSS: 0.23393 | Used in malware: unknown | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through...
Vendor	Fortinet
Product	FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS
Added Date	2026-07-16T17:00:15.684Z
Cvss Score	9.8
Epss Score	0.23393
Cvss Severity	CRITICAL
Epss Percentile	0.97528
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-07-16 18:00 UTC | Updated: 2026-07-16 18:00 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25089",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-07-16",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T03:56:23.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-07-16T00:00:00.000Z",
            "value": "CVE-2026-25089 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "5.0.5",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.8",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.8",
              "status": "affected",
              "version": "4.2.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox Cloud",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "5.0.5",
              "status": "affected",
              "version": "5.0.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox PaaS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "5.0.5",
              "status": "affected",
              "version": "5.0.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T14:27:47.492Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to upcoming  FortiSandbox version 5.2.0 or above\nUpgrade to FortiSandbox version 5.0.6 or above\nUpgrade to FortiSandbox version 4.4.9 or above\nUpgrade to upcoming  FortiSandbox PaaS version 5.2.0 or above\nUpgrade to FortiSandbox PaaS version 5.0.6 or above\nFortinet remediated this issue in FortiSandbox Cloud version 5.2.0 (not released) and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSandbox Cloud version 5.0.6 (not released) and hence customers do not need to perform any action."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-25089",
    "datePublished": "2026-06-09T14:27:47.492Z",
    "dateReserved": "2026-01-29T09:27:29.820Z",
    "dateUpdated": "2026-07-17T03:56:23.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-25089",
      "cwes": [
        "CWE-78"
      ],
      "dateAdded": "2026-07-16",
      "dueDate": "2026-07-19",
      "forensicTriage": "Yes",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-25089",
      "product": "FortiSandbox",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "shortDescription": "Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.",
      "vendorProject": "Fortinet",
      "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability"
    },
    "epss": {
      "cve": "CVE-2026-25089",
      "date": "2026-09-21",
      "epss": "0.76112",
      "percentile": "0.99522"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiSandbox",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "5.0.5",
                    "status": "affected",
                    "version": "5.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.4.8",
                    "status": "affected",
                    "version": "4.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.2.8",
                    "status": "affected",
                    "version": "4.2.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiSandbox Cloud",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "5.0.5",
                    "status": "affected",
                    "version": "5.0.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiSandbox PaaS",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "5.0.5",
                    "status": "affected",
                    "version": "5.0.4",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@fortinet.com"
          }
        ],
        "cisaActionDue": "2026-07-19",
        "cisaExploitAdd": "2026-07-16",
        "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
        "cisaVulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "814D77BE-F536-42DE-B068-F92B95D68248",
                    "versionEndIncluding": "4.2.8",
                    "versionStartIncluding": "4.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0025C9C0-8D61-4563-96F9-F4E09DD83B26",
                    "versionEndExcluding": "4.4.9",
                    "versionStartIncluding": "4.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3AAEF316-2134-4398-911C-E7532CD3AFF2",
                    "versionEndExcluding": "5.0.6",
                    "versionStartIncluding": "5.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortisandbox_cloud:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D479507F-4DD8-4455-A8DB-138AD56C6822",
                    "versionEndExcluding": "5.0.6",
                    "versionStartIncluding": "5.0.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortisandbox_paas:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "61A9A2E9-3086-4172-B3A3-212873B8C4A9",
                    "versionEndExcluding": "5.0.6",
                    "versionStartIncluding": "5.0.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests"
          },
          {
            "lang": "es",
            "value": "Una neutralizaci\u00f3n inadecuada de elementos especiales utilizados en un comando de sistema operativo (\u0027inyecci\u00f3n de comandos de sistema operativo\u0027) vulnerabilidad en Fortinet FortiSandbox 5.0.0 hasta 5.0.5, FortiSandbox 4.4.0 hasta 4.4.8, FortiSandbox 4.2 todas las versiones, FortiSandbox Cloud 5.0.4 hasta 5.0.5, FortiSandbox PaaS 5.0.4 hasta 5.0.5 puede permitir a un atacante no autenticado ejecutar comandos no autorizados a trav\u00e9s de solicitudes HTTP espec\u00edficamente dise\u00f1adas."
          }
        ],
        "id": "CVE-2026-25089",
        "lastModified": "2026-07-23T08:10:00.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "psirt@fortinet.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-25089",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-09T16:16:39.943",
        "references": [
          {
            "source": "psirt@fortinet.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"
          }
        ],
        "sourceIdentifier": "psirt@fortinet.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-10T14:59:49+00:00",
      "cve": "CVE-2026-25089",
      "id": "CVE-2026-25089",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2026-25089",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25089.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-25089",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-16T17:45:08.107935Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-07-16",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-09T15:36:07.778Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2026-07-16T00:00:00.000Z",
                "value": "CVE-2026-25089 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiSandbox",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "5.0.5",
                  "status": "affected",
                  "version": "5.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.4.8",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.2.8",
                  "status": "affected",
                  "version": "4.2.1",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiSandbox Cloud",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "5.0.5",
                  "status": "affected",
                  "version": "5.0.4",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiSandbox PaaS",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "5.0.5",
                  "status": "affected",
                  "version": "5.0.4",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "Execute unauthorized code or commands",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-09T14:27:47.492Z",
            "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
            "shortName": "fortinet"
          },
          "references": [
            {
              "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141",
              "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to upcoming  FortiSandbox version 5.2.0 or above\nUpgrade to FortiSandbox version 5.0.6 or above\nUpgrade to FortiSandbox version 4.4.9 or above\nUpgrade to upcoming  FortiSandbox PaaS version 5.2.0 or above\nUpgrade to FortiSandbox PaaS version 5.0.6 or above\nFortinet remediated this issue in FortiSandbox Cloud version 5.2.0 (not released) and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSandbox Cloud version 5.0.6 (not released) and hence customers do not need to perform any action."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "assignerShortName": "fortinet",
        "cveId": "CVE-2026-25089",
        "datePublished": "2026-06-09T14:27:47.492Z",
        "dateReserved": "2026-01-29T09:27:29.820Z",
        "dateUpdated": "2026-07-17T03:56:23.142Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-08316 (CVE-2026-25089)

Vulnerability from fstec – Published: 2026-06-17 – Updated: 2026-07-17 – View on bdu.fstec.ru Exploit exists Yes Fixed

CISA Previdian

Title

Уязвимость графического пользовательского интерфейса системы выявления и устранения угроз Fortinet FortiSandbox и FortiSandbox Cloud, позволяющая нарушителю выполнить произвольные команды посредством специально сформированных HTTP-запросов

Summary

Уязвимость графического пользовательского интерфейса системы выявления и устранения угроз Fortinet FortiSandbox и FortiSandbox Cloud связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные команды посредством специально сформированных HTTP-запросов

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Yes

Remediation

Software update

CWE

CWE-78 - Непринятие мер по нейтрализации специальных элементов, используемых в команде операционной системы (Внедрение в команду операционной системы)

Aliases

CVE-2026-25089, FG-IR-26-141

References

3 references

URL
https://fortiguard.fortinet.com/psirt/FG-IR-26-141
https://x.com/DefusedCyber/status/2066575288503255274
https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

Impacted products

3 products from 1 vendor

Vendors

Fortinet Inc.

Products

FortiSandbox, FortiSandbox PaaS, FortiSandbox Cloud

Versions

от 4.2.0 до 4.2.8 включительно (FortiSandbox), от 5.0.0 до 5.0.6 (FortiSandbox), от 4.4.0 до 4.4.9 (FortiSandbox), от 5.0.0 до 5.0.6 (FortiSandbox PaaS), от 5.0.2 до 5.0.6 (FortiSandbox Cloud)

Product types

Security device, Security software

Mitigations

Использование рекомендаций производителя: https://fortiguard.fortinet.com/psirt/FG-IR-26-141

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Fortinet Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 4.2.0 \u0434\u043e 4.2.8 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiSandbox), \u043e\u0442 5.0.0 \u0434\u043e 5.0.6 (FortiSandbox), \u043e\u0442 4.4.0 \u0434\u043e 4.4.9 (FortiSandbox), \u043e\u0442 5.0.0 \u0434\u043e 5.0.6 (FortiSandbox PaaS), \u043e\u0442 5.0.2 \u0434\u043e 5.0.6 (FortiSandbox Cloud)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://fortiguard.fortinet.com/psirt/FG-IR-26-141",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "17.07.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "17.06.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-08316",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-25089, FG-IR-26-141",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "FortiSandbox, FortiSandbox PaaS, FortiSandbox Cloud",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 Fortinet FortiSandbox \u0438 FortiSandbox Cloud, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b) (CWE-78)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 Fortinet FortiSandbox \u0438 FortiSandbox Cloud \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141\nhttps://x.com/DefusedCyber/status/2066575288503255274\nhttps://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-78",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CERTFR-2026-AVI-0725

Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10

De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Fortinet	FortiOS	FortiOS versions 7.6.x antérieures à 7.6.3
Fortinet	FortiSandbox	FortiSandbox Cloud versions 5.0.4 et 5.0.5 antérieures à 5.0.6
Fortinet	FortiPortal	FortiPortal versions antérieures à 7.2.9
Fortinet	FortiSandbox	FortiSandbox versions 5.0.x antérieures à 5.0.6
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.15
Fortinet	FortiSandbox	FortiSandbox versions 4.4.x antérieures à 4.4.9
Fortinet	FortiPortal	FortiPortal versions 7.4.x antérieures à 7.4.8
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.11
Fortinet	FortiProxy	FortiProxy versions 7.4.x antérieures à 7.4.11
Fortinet	FortiSandbox	FortiSandbox PaaS versions 5.0.4 et 5.0.5 antérieures à 5.0.6
Fortinet	FortiOS	FortiOS versions 7.4.x antérieures à 7.4.8
Fortinet	FortiProxy	FortiProxy versions 7.6.x antérieures à 7.6.4

References

Title

Publication Time

CNVD-2026-25587

Vulnerability from cnvd - Published: 2026-06-29

Title

Fortinet FortiSandbox OS命令注入漏洞（CNVD-2026-25587）

Description

FortiSandbox是一款由Fortinet提供的安全沙箱产品，主要用于检测和分析恶意软件。 Fortinet FortiSandbox存在OS命令注入漏洞。该漏洞源于未能正确中和OS命令中使用的特殊元素，攻击者可利用该漏洞通过特制的HTTP请求执行未授权命令。

Severity

高

Patch Name

Fortinet FortiSandbox OS命令注入漏洞（CNVD-2026-25587）的补丁

Patch Description

FortiSandbox是一款由Fortinet提供的安全沙箱产品，主要用于检测和分析恶意软件。 Fortinet FortiSandbox存在OS命令注入漏洞。该漏洞源于未能正确中和OS命令中使用的特殊元素，攻击者可利用该漏洞通过特制的HTTP请求执行未授权命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://fortiguard.fortinet.com/psirt/FG-IR-26-141

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-25089

Impacted products

Name
['Fortinet FortiSandbox >=4.4.0，<=4.4.8', 'Fortinet FortiSandbox >=4.2.1，<=4.2.8', 'Fortinet FortiSandbox >=5.0.0，<=5.0.5', 'Fortinet FortiSandbox Cloud >=5.0.4，<=5.0.5', 'Fortinet FortiSandbox PaaS >=5.0.4，<=5.0.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-25089",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-25089"
    }
  },
  "description": "FortiSandbox\u662f\u4e00\u6b3e\u7531Fortinet\u63d0\u4f9b\u7684\u5b89\u5168\u6c99\u7bb1\u4ea7\u54c1\uff0c\u4e3b\u8981\u7528\u4e8e\u68c0\u6d4b\u548c\u5206\u6790\u6076\u610f\u8f6f\u4ef6\u3002\n\nFortinet  FortiSandbox\u5b58\u5728OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u6b63\u786e\u4e2d\u548cOS\u547d\u4ee4\u4e2d\u4f7f\u7528\u7684\u7279\u6b8a\u5143\u7d20\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u5236\u7684HTTP\u8bf7\u6c42\u6267\u884c\u672a\u6388\u6743\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://fortiguard.fortinet.com/psirt/FG-IR-26-141",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-25587",
  "openTime": "2026-06-29",
  "patchDescription": "FortiSandbox\u662f\u4e00\u6b3e\u7531Fortinet\u63d0\u4f9b\u7684\u5b89\u5168\u6c99\u7bb1\u4ea7\u54c1\uff0c\u4e3b\u8981\u7528\u4e8e\u68c0\u6d4b\u548c\u5206\u6790\u6076\u610f\u8f6f\u4ef6\u3002\r\n\r\nFortinet  FortiSandbox\u5b58\u5728OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u6b63\u786e\u4e2d\u548cOS\u547d\u4ee4\u4e2d\u4f7f\u7528\u7684\u7279\u6b8a\u5143\u7d20\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7279\u5236\u7684HTTP\u8bf7\u6c42\u6267\u884c\u672a\u6388\u6743\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Fortinet FortiSandbox OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2026-25587\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Fortinet FortiSandbox \u003e=4.4.0\uff0c\u003c=4.4.8",
      "Fortinet FortiSandbox \u003e=4.2.1\uff0c\u003c=4.2.8",
      "Fortinet FortiSandbox \u003e=5.0.0\uff0c\u003c=5.0.5",
      "Fortinet FortiSandbox Cloud \u003e=5.0.4\uff0c\u003c=5.0.5",
      "Fortinet FortiSandbox PaaS \u003e=5.0.4\uff0c\u003c=5.0.5"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-25089",
  "serverity": "\u9ad8",
  "submitTime": "2026-06-11",
  "title": "Fortinet FortiSandbox OS\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2026-25587\uff09"
}

FKIE_CVE-2026-25089

Vulnerability from fkie_nvd - Published: 2026-06-09 16:16 - Updated: 2026-07-23 08:10

CISA Previdian

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@fortinet.com	https://fortiguard.fortinet.com/psirt/FG-IR-26-141	Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089	US Government Resource

Impacted products

Vendor	Product	Version
fortinet	fortisandbox	*
fortinet	fortisandbox	*
fortinet	fortisandbox	*
fortinet	fortisandbox_cloud	*
fortinet	fortisandbox_paas	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "5.0.5",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.8",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.8",
              "status": "affected",
              "version": "4.2.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox Cloud",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "5.0.5",
              "status": "affected",
              "version": "5.0.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox PaaS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "5.0.5",
              "status": "affected",
              "version": "5.0.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "cisaActionDue": "2026-07-19",
  "cisaExploitAdd": "2026-07-16",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "814D77BE-F536-42DE-B068-F92B95D68248",
              "versionEndIncluding": "4.2.8",
              "versionStartIncluding": "4.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0025C9C0-8D61-4563-96F9-F4E09DD83B26",
              "versionEndExcluding": "4.4.9",
              "versionStartIncluding": "4.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3AAEF316-2134-4398-911C-E7532CD3AFF2",
              "versionEndExcluding": "5.0.6",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox_cloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D479507F-4DD8-4455-A8DB-138AD56C6822",
              "versionEndExcluding": "5.0.6",
              "versionStartIncluding": "5.0.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox_paas:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "61A9A2E9-3086-4172-B3A3-212873B8C4A9",
              "versionEndExcluding": "5.0.6",
              "versionStartIncluding": "5.0.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests"
    },
    {
      "lang": "es",
      "value": "Una neutralizaci\u00f3n inadecuada de elementos especiales utilizados en un comando de sistema operativo (\u0027inyecci\u00f3n de comandos de sistema operativo\u0027) vulnerabilidad en Fortinet FortiSandbox 5.0.0 hasta 5.0.5, FortiSandbox 4.4.0 hasta 4.4.8, FortiSandbox 4.2 todas las versiones, FortiSandbox Cloud 5.0.4 hasta 5.0.5, FortiSandbox PaaS 5.0.4 hasta 5.0.5 puede permitir a un atacante no autenticado ejecutar comandos no autorizados a trav\u00e9s de solicitudes HTTP espec\u00edficamente dise\u00f1adas."
    }
  ],
  "id": "CVE-2026-25089",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25089",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T16:16:39.943",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GW24-HWF5-92H2

Vulnerability from github – Published: 2026-06-09 18:30 – Updated: 2026-07-16 18:31

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-25089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T16:16:39Z",
    "severity": "CRITICAL"
  },
  "details": "A improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests",
  "id": "GHSA-gw24-hwf5-92h2",
  "modified": "2026-07-16T18:31:23Z",
  "published": "2026-06-09T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25089"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0189

Vulnerability from csaf_ncscnl - Published: 2026-06-11 08:06 - Updated: 2026-06-11 08:06

Summary

Kwetsbaarheid verholpen in Fortinet FortiSandbox

Scope

1 vulnerability in this advisory, including CVE-2026-25089.

CVE-2026-25089

Fortinet FortiSandbox versions 4.2 through 5.0.5, including Cloud and PaaS variants, contain an OS command injection vulnerability allowing unauthenticated attackers to execute unauthorized commands via crafted HTTP requests.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Known affected: 3 products

Open the full advisory

WID-SEC-W-2026-1836

Vulnerability from csaf_certbund - Published: 2026-06-09 22:00 - Updated: 2026-06-15 22:00

Summary

Fortinet FortiSandbox: Schwachstelle ermöglicht Befehlsausführung

Severity

Kritisch

Scope

1 vulnerability in this advisory, including CVE-2026-25089.

CVE-2026-25089

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-25089 (GCVE-0-2026-25089)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

BDU:2026-08316 (CVE-2026-25089)

CERTFR-2026-AVI-0725

Solutions

CNVD-2026-25587

FKIE_CVE-2026-25089

GHSA-GW24-HWF5-92H2

NCSC-2026-0189

WID-SEC-W-2026-1836

Tags

Sightings

Nomenclature

Related by attack behaviour