CVE-2026-25089 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-09

Added to CISA KEV: 2026-07-16 37 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Web UI/HTTP access logs for anomalous requests to the 'start VNC' endpoint, unexpected process/command execution, new accounts, and unauthorized configuration changes. Verify appliance integrity.
Immediately upgrade to FortiSandbox 5.0.6+ or 4.4.9+ (and 5.2.0 when released). FortiSandbox Cloud is remediated by Fortinet with no customer action; upgrade FortiSandbox PaaS to 5.0.6+/5.2.0+. FortiSandbox 4.2 has no fixed line listed - migrate to a supported version.
Immediately restrict access to the FortiSandbox Web UI/management interface to trusted administrative networks only; ensure it is NOT exposed to the internet. Use ACLs, VPN-only access, or trusted-host restrictions per Fortinet FG-IR-26-141 guidance.
Patch priority: EMERGENCY / P0 - unauthenticated RCE in a security appliance with confirmed active exploitation. Patch or isolate within 24-72 hours (or per CISA BOD 22-01 KEV due date).

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-25089 is a critical OS command injection vulnerability (CWE-78) affecting Fortinet's FortiSandbox product. The flaw exists within the Web UI, specifically involving the "start VNC" feature, where improper neutralization of special elements in HTTP requests allows an unauthenticated attacker to inject and execute arbitrary operating system commands. This vulnerability is significant because it provides remote, unauthenticated access to the underlying system, leading to full compromise of the affected appliance.

Exploitation

Active Exploitation: The vulnerability is being actively exploited in the wild; CISA added it to their Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026 ^[1].
Threat Actors: While specific named threat actor groups or ransomware campaigns associated with this CVE were not detailed in the available reports, the active exploitation indicates that malicious actors are successfully targeting vulnerable systems.
Proof-of-Concept/Exploit Tools: While specific public exploit code was not explicitly cited, the vulnerability is reached by sending specifically crafted HTTP requests containing shell metacharacters via JSON payloads to the "start VNC" endpoint.
Attack Prerequisites:

* Network: Remote, network-accessible deployment. * Authentication: None required (unauthenticated). * User Interaction: None required.

Affected Products & Patches

Affected Versions:

* FortiSandbox 5.0.0 through 5.0.5 ^[2] * FortiSandbox 4.4.0 through 4.4.8 ^[2] * FortiSandbox 4.2 (all versions) * FortiSandbox Cloud 5.0.4 through 5.0.5 * FortiSandbox PaaS 5.0.4 through 5.0.5 * Patch Availability: Fortinet has released patches to address this vulnerability. Administrators are advised to update their systems immediately to the latest secure versions provided by the vendor.

Mitigations: Organizations that cannot immediately patch are advised to follow vendor-specific guidance for hardening the Web UI or restricting access to the interface.

Impact

Access/Capabilities: Successful exploitation grants an attacker the ability to execute unauthorized commands with the privileges of the application, typically resulting in full system-level control.
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it allows external attackers to gain a foothold in the corporate network, potentially leading to data exfiltration, lateral movement, or complete disruption of security services provided by the FortiSandbox.

Sources

CVE-2026-25089: Fortinet Fortisandbox OS command injection — actively ...
This is RED because CISA confirmed active exploitation and added CVE-2026-25089 to its KEV catalog on 2026-07-16, with a required remediation due date of 2026-07-19. That means attackers are already working against vulnerable FortiSandbox systems, so you should prioritize upgrading and applying the…
CVE-2026-25089 | Arctic Wolf
CVE-2026-25089 is a critical OS command injection vulnerability discovered in Fortinet FortiSandbox versions 4.4.0–4.4.8, 5.0.0–5.0.5, and corresponding Cloud and Platform as a Service deployments.

🔴 CVE-2026-25089