~/f4n6 $ grep -r "CVE-2026-25089 — Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability" ./investigations/ --include="*.md"

CVE-2026-25089 — Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability

Jeff Davies 16 Jul 2026 7 min read

1. Executive summary

CVE-2026-25089 is a critical (CVSS 9.8, CWE-78) OS command injection vulnerability in Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. It enables an unauthenticated, remote attacker to execute arbitrary operating system commands via crafted HTTP requests to the FortiSandbox WEB UI. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-07-16 with a remediation due date of 2026-07-19; threat-intelligence firm Defused reports active in-the-wild exploitation alongside two related FortiSandbox CVEs (CVE-2026-39813, CVE-2026-39808). EMEA financial services running affected FortiSandbox versions face immediate risk of unauthenticated appliance compromise — particularly severe because FortiSandbox feeds threat verdicts to other Fortinet security products, meaning compromise can cascade into enforcement and automated-response pipelines.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities CISA KEV addition confirms active exploitation of a CVSS 9.8 unauthenticated RCE on a security appliance that other Fortinet products depend on for threat verdicts. If an affected FortiSandbox instance is identified in your estate, the combination of critical severity, active exploitation, and potential for appliance compromise likely meets the classification threshold for a major ICT-related incident, triggering DORA Art. 19 reporting timelines.
DORA Art. 24 — digital operational resilience testing — general requirements FortiSandbox Cloud and FortiSandbox PaaS are managed security services; the vulnerability is exploitable in these cloud variants (5.0.4–5.0.5), and CISA KEV requires applying vendor mitigations or discontinuing use if mitigations are unavailable. Clients must verify that their FortiSandbox Cloud/PaaS provider has applied the fix or compensating controls, and exercise contractual escalation rights if the provider cannot confirm remediation.

3. Technical analysis & attack chain

Affected versions (from NVD)

  • FortiSandbox 4.4.0 through 4.4.8
  • FortiSandbox 5.0.0 through 5.0.5
  • FortiSandbox 4.2 — all versions
  • FortiSandbox Cloud 5.0.4 through 5.0.5
  • FortiSandbox PaaS 5.0.4 through 5.0.5

Attack chain (confirmed steps)

  1. Initial access — unauthenticated HTTP request to FortiSandbox WEB UI. The attacker sends a specifically crafted HTTP request to the FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS WEB UI. No authentication is required (CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is an OS command injection (CWE-78) — improper neutralization of special elements used in an OS command.
  2. Command execution. The crafted request causes the FortiSandbox WEB UI to pass attacker-controlled input into an OS-level command without adequate sanitisation, resulting in arbitrary command execution on the underlying appliance OS with the privileges of the web service process.
  3. Post-exploitation — undefined in source material. The NVD entry, CISA KEV record, and press coverage do not describe specific post-exploitation payloads, persistence mechanisms, C2 channels, or data exfiltration techniques. Defused notes that the exploit for CVE-2026-25089 "appeared to be vibe coded and may be faulty," suggesting the current exploit may be unreliable — but this does not reduce the severity of the underlying vulnerability.

Defused reported exploitation of three FortiSandbox vulnerabilities within a 24-hour window. The other two are:

  • CVE-2026-39813 — path traversal in the FortiSandbox JRPC API enabling authentication bypass via crafted HTTP requests. Affects FortiSandbox 4.4.0–4.4.8 and 5.0.0–5.0.5. Patched in 4.4.9+ / 5.0.6+. (CVSS 9.1 per source reporting; not in verified reference data for this advisory.)
  • CVE-2026-39808 — OS command injection in FortiSandbox, unauthenticated, via HTTP requests. Affects FortiSandbox 4.4.0–4.4.8. Patched in 4.4.9+. (CVSS 9.1 per source reporting; not in verified reference data for this advisory.)

CVSS discrepancy note: The verified reference data assigns CVSS 9.8 (Critical) for CVE-2026-25089. The Register and The Hacker News report CVSS 9.1. The NVD CVSS 3.x vector string (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) computes to 9.8. We use the verified 9.8 value throughout this advisory; the 9.1 figure in press coverage may reflect an earlier vendor assessment or a scoring methodology difference.

Attribution caveat: No named threat actor is identified in any source. Defused is the sole intelligence source reporting active exploitation; this is single-sourced — verify before enforcement. Fortinet has not publicly confirmed exploitation per The Register's reporting.

Ransomware: CISA KEV lists "Known ransomware campaign use: Unknown." No source attributes this activity to a ransomware crew. Check Point's Lotem Finkelstein separately warned about ransomware actors exploiting Fortinet VPN vulnerabilities, but this is a different product line and no link to CVE-2026-25089 is established.

4. Mitigation & containment

P1 — within 24 hours (CISA KEV due date is 2026-07-19)

  1. Inventory and identify exposure. Locate all FortiSandbox appliances, FortiSandbox Cloud tenants, and FortiSandbox PaaS instances. Check versions against the affected ranges listed in §3. Pay particular attention to internet-facing WEB UI ports.
  2. Patch to fixed versions. Upgrade affected FortiSandbox deployments: - FortiSandbox 4.4.x → upgrade to 4.4.9 or above - FortiSandbox 5.0.x → upgrade to 5.0.6 or above - FortiSandbox 4.2 → upgrade to a supported branch (4.4.9+ or 5.0.6+); 4.2 has no fixed version on its own branch - FortiSandbox Cloud / PaaS 5.0.4–5.0.5 → apply vendor-provided patch or confirm cloud-side remediation with Fortinet
  3. If patching is not immediately possible — restrict network access. Place access control lists or firewall rules in front of the FortiSandbox WEB UI to limit exposure to only trusted management networks. The WEB UI should never be internet-facing; if it is, block external access immediately as a compensating control.
  4. For FortiSandbox Cloud / PaaS — confirm provider remediation. Contact Fortinet support to confirm that your tenant has been patched. If the provider cannot confirm remediation, follow CISA KEV guidance: discontinue use of the product until mitigations are available.

P2 — within 72 hours

  1. Patch or contain the two related CVEs. CVE-2026-39813 (JRPC API path traversal / auth bypass) and CVE-2026-39808 (OS command injection) affect overlapping version ranges and are under the same exploitation campaign per Defused. Apply the same version upgrades (4.4.9+ / 5.0.6+) to close all three.
  2. Conduct forensic triage. Per CISA KEV required action, perform forensics triage on any FortiSandbox instance that was running an affected version and had WEB UI network exposure. Look for evidence of command execution, unexpected processes, outbound connections, and configuration changes. CISA's "Forensics Triage Requirements" guidance applies.
  3. Review dependent Fortinet products. FortiSandbox provides threat verdicts to other Fortinet security products (FortiGate, FortiMail, FortiClient, etc.). If FortiSandbox was compromised, assess whether attacker-controlled verdicts could have suppressed blocking decisions or triggered malicious automated responses on downstream products.

P3 — within 7 days

  1. Validate patch deployment across the full estate. Confirm all instances — including HA peers, DR sites, and cloud tenants — are running fixed versions.
  2. Review WEB UI exposure posture. Ensure FortiSandbox management interfaces are restricted to dedicated management VLANs or jump-host access only. Document any remaining internet-facing management interfaces and justify with a risk acceptance.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material for CVE-2026-25089 exploitation.

Behavioural indicators

Behaviour Where to observe Confidence
Unauthenticated HTTP requests to FortiSandbox WEB UI containing command-injection payloads (special characters, shell metacharacters in HTTP parameters) FortiSandbox WEB UI access logs; WAF/reverse proxy logs in front of FortiSandbox; network IDS Medium — consistent with CWE-78 mechanism, but no specific payload examples in sources
Unexpected outbound network connections from FortiSandbox appliance Firewall egress logs; FortiSandbox system logs Medium — post-exploitation behaviour expected from OS command execution, not specifically described in sources
Anomalous or modified threat verdicts from FortiSandbox FortiGate / FortiMail / FortiClient logs referencing FortiSandbox verdicts Low — Help Net Security notes FortiSandbox feeds verdicts to dependent products, but no specific tampering observed in sources

6. Detection

Insufficient indicators to author detection rules. No specific payloads, command strings, file paths, mutex names, or other threat artefacts are present in the source material. The behavioural indicators in §5 should be operationalised as log-review procedures rather than signature-based detection until specific exploit artefacts become available.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-25089 9.8 Critical ⚠ KEV 2026-07-16 23% A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSan…

7. Sources

  • NVD — CVE-2026-25089 Detail — https://nvd.nist.gov/vuln/detail/CVE-2026-25089 — 2026-07-15
  • CISA Known Exploited Vulnerabilities Catalog — CVE-2026-25089 entry (added 2026-07-16, due 2026-07-19) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089
  • The Register — "Three critical Fortinet sandbox bugs splattered by unknown attackers" — https://www.theregister.com/security/2026/06/16/three-critical-fortinet-sandbox-bugs-splattered-by-unknown-attackers/5256461 — 2026-06-16
  • The Hacker News — "Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities" — https://thehackernews.com/2026/06/ivanti-fortinet-and-sap-release-patches.html — 2026-06
  • Help Net Security — "Attackers are exploiting FortiSandbox vulnerabilities" — https://www.helpnetsecurity.com/2026/06/16/fortisandbox-vulnerabilities-cve-2026-39813-cve-2026-39808-cve-2026-25089/ — 2026-06-16
  • Cybersecurity Dive — "Critical vulnerabilities in Fortinet FortiSandbox are under exploitation" — https://www.cybersecuritydive.com/news/critical-vulnerabilities-fortinet-fortisandbox-exploitation/823027/ — 2026-06
  • BSI Germany (WID-SEC-2026-1836) — "Fortinet FortiSandbox: Schwachstelle ermöglicht Befehlsausführung" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1836 — 2026-07
  • NVD — CVE-2026-39808 Detail (related CVE context) — https://nvd.nist.gov/vuln/detail/CVE-2026-39808

8. Adverse Trace position

Severity: Critical. CVE-2026-25089 is a CVSS 9.8 unauthenticated, remote OS command injection on a security-critical appliance. CISA KEV inclusion with active exploitation (SSVC: exploitation=active, automatable=yes, technical impact=total) confirms this is not theoretical. The three-day CISA remediation window (2026-07-16 to 2026-07-19) reflects the urgency. For EMEA financial services, the risk is compounded by FortiSandbox's role as a verdict engine for downstream Fortinet enforcement — compromise can degrade or subvert the broader security stack, not just the sandbox itself. Attribution is unconfirmed; exploitation reporting is single-sourced to Defused. No ransomware link is established. Client action: identify and patch all affected FortiSandbox instances by 2026-07-19; restrict WEB UI access where patching is delayed; forensically triage any instance with prior exposure. Adverse Trace will monitor for emerging IOCs, exploit code publication, and any confirmed actor attribution, and will issue an update if the threat picture materially changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies