CVE-2026-25089

This vulnerability is like a “door” in FortiSandbox where a malicious request can trick the system into running attacker-chosen commands. Because attackers are already using it in the wild, an exposed device could be taken over and used to steal data or disrupt operations.

This matters if you run Fortinet FortiSandbox (including FortiSandbox Cloud or FortiSandbox PaaS) and your version falls within the vulnerable ranges covered by CVE-2026-25089 (5.0.0–5.0.5 or 4.4.0–4.4.8, plus affected 5.0.4–5.0.5 Cloud/PaaS). It’s a risk when the FortiSandbox service is reachable by attackers, especially via internet-accessible HTTP requests; CISA’s guidance also expects you to assess each asset’s internet exposure. Reachability is the gate—if it isn’t reachable from the attacker’s side, the risk is reduced, but known exploitation means you should not assume it’s safe.

This is RED because CISA confirmed active exploitation and added CVE-2026-25089 to its KEV catalog on 2026-07-16, with a required remediation due date of 2026-07-19. That means attackers are already working against vulnerable FortiSandbox systems, so you should prioritize upgrading and applying the vendor mitigations immediately.

Confirm exposure

• Find where Fortinet FortiSandbox is deployed: on-prem FortiSandbox, FortiSandbox Cloud, and/or FortiSandbox PaaS.
• Record the exact installed version(s). This CVE affects multiple ranges (FortiSandbox 5.0.0–5.0.5 and 4.4.0–4.4.8; and Cloud/PaaS 5.0.4–5.0.5) per the provided scope.
• Determine whether the FortiSandbox management/service interface is reachable from the internet over HTTP. CISA’s KEV instructions specifically call out evaluating each asset’s internet exposure.

Patch / upgrade (fixed versions)

• FortiSandbox Cloud: upgrade to 5.0.6.
• FortiSandbox PaaS: upgrade to 5.0.6.
• FortiSandbox (on-prem): upgrade to a fixed release per Fortinet guidance (included in the findings as FortiSandbox 5.0.6 or above, and FortiSandbox 4.4.9 or above).

If you can’t patch right away (temporary mitigation)

• Apply Fortinet PSIRT mitigations referenced in the findings (FG-IR-26-141).
• Reduce risk by limiting network reachability: ensure the FortiSandbox interface is only accessible from approved internal networks (and not broadly from the internet).

Timing / due date

• CISA KEV remediation due date: 2026-07-19.

What to monitor

• After upgrading/mitigations, review FortiSandbox-related logs for signs of command execution attempts tied to suspicious HTTP requests.
• Continue monitoring closely for unusual process/activity patterns and repeated exploit-like request patterns until you are confident the vulnerable version is fully eliminated from your environment.

CVE-2026-25089 is an OS command injection (CWE-78) in Fortinet FortiSandbox. The weakness is improper neutralization of special elements used in an operating system command, which can allow an attacker to execute unauthorized commands through specially crafted HTTP requests.

Exploitation status: Confirmed active exploitation—CISA added the issue to its KEV catalog (added 2026-07-16) and CISA remediation instructions apply, with a due date of 2026-07-19; real-world reporting also indicates exploitation activity.

Exploit maturity: The findings indicate real-world exploitation in the wild; no public exploit code is listed in the provided sources.

EPSS is not used for prioritization here because KEV/news confirm exploitation; the traffic-light verdict is RED based on confirmed exploitation and KEV status.

Impact potential aligns with the ability to run commands: potential full compromise (confidentiality and integrity risk) and service disruption (availability impact).