CVE-2026-25089 Fortinet FortiSandbox
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5,…
- CVSS
- 9.1 Critical
- EPSS
- 76%
- Percentile
- 100
- Published
- 2026-06-09
- Force
- 10 of 12
- Public PoC
- 2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
On CISA’s exploited list
Fortinet FortiSandbox OS Command Injection Vulnerability
- Added
- 2026-07-16
- Federal patch deadline
- 2026-07-19
- Ransomware use
- not known