OS Command Injection in FortiSandbox - CVE-2026-25089
Published: June 9, 2026 / Updated: July 16, 2026
Vulnerability identifier: #VU134004
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-25089
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements used in an os command ('os command injection') on start vnc feature. An unauthenticated attacker can execute unauthorized commands via specifically crafted HTTP requests.
Affected software
FortiSandbox
How to mitigate CVE-2026-25089
Install update from vendor's website.
FortiSandbox - addressed in versions 4.4.9, 5.0.6