CVE-2026-25089: Second-Order OS Command Injection via JSON Input on start vnc feature
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests
Other sources
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
— FortiGuard
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiSandboxto a version that resolves this vulnerability.Fixed in 4.4.9 - Upgrade
Upgrade
Fortinet FortiSandboxto a version that resolves this vulnerability.Fixed in 5.0.6 - Upgrade
Upgrade
Fortinet FortiSandbox PaaSto a version that resolves this vulnerability.Fixed in 5.0.6 - Upgrade
Upgrade
Fortinet FortiSandbox PaaSto a version that resolves this vulnerability.Fixed in 5.2.0 - Compensating control
Evaluate each asset's internet exposure and ensure adherence to CISA BOD 26-04 patching/priority guidance; if BOD 26-04 mitigations for cloud services are unavailable, discontinue use of the product.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25089?
The severity of CVE-2026-25089 is critical with a score of 9.8.
How do I fix CVE-2026-25089?
To fix CVE-2026-25089, upgrade to FortiSandbox version 5.2.0 or above, or to version 5.0.6, 4.4.9, or the specific PaaS versions mentioned.
What type of vulnerability is CVE-2026-25089?
CVE-2026-25089 is classified as an OS Command Injection vulnerability.
Which software is affected by CVE-2026-25089?
CVE-2026-25089 affects Fortinet FortiSandbox versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, all versions of 4.2, and specific Cloud and PaaS versions.
What is the risk associated with CVE-2026-25089?
The risk associated with CVE-2026-25089 is rated as 86, indicating a high likelihood of exploitation.