CVE-2026-25089

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-25089 9.8

Fortinet · FortiSandbox · Added 2026-07-16 · Published 2026-06-09

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityFortinet FortiSandbox OS Command Injection Vulnerability

VendorFortinet

ProductFortiSandbox

Date added2026-07-16

Due date2026-07-19

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-78

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

NVD: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 19:47 UTC

Wall time0.4s

Searches5

Component defaultyes

Sources https://www.fortiguard.com/psirt?cve=CVE-2026-25089
https://fortiguard.fortinet.com/psirt/FG-IR-26-141
https://nvd.nist.gov/vuln/detail/CVE-2026-25089
https://github.com/0xBlackash/CVE-2026-25089
https://github.com/HORKimhab/CVE-2026-25089
https://arcticwolf.com/resources/blog/cve-2026-25089/
https://www.secpod.com/learn/security-research/breaking-down-cve-2026-25089-unauthenticated-command-injection-in-forti-sandbox-forti-sandbox-cloud-and-forti-sandbox-paa-s
https://threatprotect.qualys.com/2026/06/17/fortinet-fortisandbox-vulnerability-exploited-by-attackers-cve-2026-39808-cve-2026-25089-cve-2026-39813/
https://ccb.belgium.be/advisories/warning-fortinet-addresses-critical-command-injection-vulnerability-fortisandbox-patch

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

warn component_extraction: Component 'FortiSandbox VNC start API endpoint (/api/vnc/start) — vm_name parameter passed unsanitized to start_vnc.sh shell command' matches or contains product name 'FortiSandbox' — no specific component identified

Hunting hypothesis agent

Hunt for HTTP POST requests to /api/vnc/start on FortiSandbox where the JSON vm_name field contains shell metacharacters (semicolons, backticks), then look for spawned id/whoami processes and outbound reverse shell connections.

Research details

ComponentFortiSandbox VNC start API endpoint (/api/vnc/start) — vm_name parameter passed unsanitized to start_vnc.sh shell command

PreconditionsNetwork reachability to FortiSandbox WEB UI (administrative HTTP interface) — no authentication required. The OS command injection (CWE-78) exists in the WEB UI component of FortiSandbox versions 5.0.0-5.0.5, 4.4.0-4.4.8, and 4.2.x, as well as FortiSandbox Cloud 5.0.4-5.0.5 and FortiSandbox PaaS 5.0.4-5.0.5. FortiGuard advisory FG-IR-26-141 (June 9, 2026). Patched versions: 5.0.6 and 4.4.9. Multiple public PoCs available (0xBlackash, HORKimhab). Arctic Wolf, Qualys, and SecPod have published analyses. Belgium CSIRT has issued public warning. The WEB UI is the primary management interface and is enabled by default on FortiSandbox appliances. agent

DeliveryNetwork (HTTP/HTTPS to FortiSandbox WEB UI); unauthenticated POST to /api/vnc/start with JSON body containing shell metacharacters in the vm_name field, which gets interpolated into a shell command (start_vnc.sh --vm '<vm_name>') without sanitization.

Public PoCyes

PoC URLs https://github.com/0xBlackash/CVE-2026-25089
https://github.com/HORKimhab/CVE-2026-25089 Third-party repos; verify before use.

Advisoryhttps://www.fortiguard.com/psirt?cve=CVE-2026-25089

Exploit notesMultiple functional public PoCs (0xBlackash, HORKimhab). Exploit sends POST to /api/vnc/start with vm_name containing shell injection (e.g. "test;id;whoami"). Backend constructs start_vnc.sh --vm '<vm_name>' --port <port> --extra '<extra>' without escaping. Default payload executes id/whoami/cat /etc/passwd; reverse shell to attacker port 4444 is possible. Tested on FortiSandbox 4.4.6 / 5.0.4. CVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8).

SummaryCritical (CVSS 9.8) unauthenticated OS command injection in Fortinet FortiSandbox WEB UI (5.0.0-5.0.5, 4.4.0-4.4.8, 4.2.x, Cloud 5.0.4-5.0.5, PaaS 5.0.4-5.0.5). Multiple public PoCs available. Patch version: 5.0.6 / 4.4.9. Exploitation allows full appliance compromise and RCE. Internet-exposed FortiSandbox instances are high priority for remediation.

Tia coverage

First reported2026-06-10

First exploit report2026-06-16

Exploit report → KEV30 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-cve-2026-58644-sharepoint-rce-zero-day-and-two-fortine fortinet-fortisandbox-critical-flaws-cve-2026-39813-cve-2026-398 ivanti-sentry-max-severity-rce-auth-bypass-cve-2026-10520-cvss-1

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.