CVE catalog

CVE-2026-25089

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox

[CVE catalog]

Severity
Critical · CVSS 9.8
Published
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
76.11% · Oct 25, 2026

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpefortisandboxNot reportedNot reportedunknown
CpefortisandboxNot reported4.4.9fixed
CpefortisandboxNot reported5.0.6fixed
Cpefortisandbox_cloudNot reported5.0.6fixed
Cpefortisandbox_paasNot reported5.0.6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpefortisandboxcpeNot reported4.4.9Not reportedNot reportedNot reported
CpefortisandboxcpeNot reported5.0.6Not reportedNot reportedNot reported
Cpefortisandbox_cloudcpeNot reported5.0.6Not reportedNot reportedNot reported
Cpefortisandbox_paascpeNot reported5.0.6Not reportedNot reportedNot reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [National Vulnerability Database (NVD)]