CVE-2026-25089 in fortinet fortisandbox
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests
Affected software: fortinet fortisandbox, fortinet fortisandbox cloud, fortinet fortisandbox paas
Scores
- CVSS: 9.8 (critical)
- EPSS: 76.11% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-07-16
- Published: 2026-06-09
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade FortiSandbox for OS command injection (FG-IR-26-100, FG-IR-26-141)
Patch or upgrade. Two unauthenticated command injection flaws in the FortiSandbox web UI let attackers run OS commands on the appliance. Upgrading to FortiSandbox 4.4.9 or 5.0.6 (or 5.2) closes both.
Applies to: FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, all 4.2 versions; FortiSandbox Cloud and PaaS 5.0.4-5.0.5. FortiSandbox 5.2 is not affected.
- Find every FortiSandbox appliance, VM, Cloud and PaaS instance and note its version under Dashboard > System Information (or run 'status' on the CLI).
- FortiSandbox 5.0.0 to 5.0.5: upgrade to 5.0.6 or later (FG-IR-26-141).
- FortiSandbox 4.4.0 to 4.4.8: upgrade to 4.4.9 or later; this fixes both FG-IR-26-100 (CVE-2026-39808) and FG-IR-26-141 (CVE-2026-25089).
- FortiSandbox 4.2 (all versions are affected, no fix on this branch): upgrade to 4.4.9 or later, or 5.0.6 or later, following the Fortinet upgrade path.
- FortiSandbox PaaS 5.0.4 to 5.0.5: upgrade the instance to 5.0.6 or later. FortiSandbox Cloud 5.0.4 to 5.0.5: confirm with Fortinet support that your Cloud instance runs 5.0.6 or later.
- Until patched, allow HTTPS access to the FortiSandbox web UI only from management networks (local-in policy or upstream firewall) and never from the internet.
- Because the flaw is exploited in the wild, check the appliance after the upgrade: review admin accounts, the system event log for unexpected commands or reboots, and outbound connections from the appliance; open a case with Fortinet if anything is unknown.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.