Fortinet FortiSandbox

CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8)

Fortinet patched CVE-2026-25089 (CWE-78) on 2026-06-09: the FortiSandbox web interface's "start vnc" feature passes attacker-controlled JSON input to an OS command, a second-order injection that "may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests" (Fortinet PSIRT FG-IR-26-141, 2026-06-09). Affected are FortiSandbox 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8 plus FortiSandbox Cloud and PaaS 5.0.4 through 5.0.5; the fix is 5.0.6 or 4.4.9, and the 5.2 branch is not affected (Fortinet PSIRT FG-IR-26-141, 2026-06-09). CCB Belgium urged immediate patching and warned that a public proof-of-concept raises the likelihood of exploitation (CCB Belgium, 2026-06-11).

The same upgrade closes two April flaws that Defused reported under attack alongside it. CVE-2026-39813 is a path traversal in the JRPC API that lets an unauthenticated attacker bypass authentication on 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8 (Fortinet PSIRT FG-IR-26-112, 2026-04-14). CVE-2026-39808 is an OS command injection through an API endpoint that gives an unauthenticated attacker command execution on 4.4.0 through 4.4.8, with 5.0 not affected (Fortinet PSIRT FG-IR-26-100, 2026-04-14). Fortinet's three advisories give all three flaws the same CVSS 3.1 vector, which scores 9.8 before the temporal adjustment behind the 9.1 they display (Fortinet PSIRT FG-IR-26-141, 2026-06-09) (Fortinet PSIRT FG-IR-26-112, 2026-04-14) (Fortinet PSIRT FG-IR-26-100, 2026-04-14). No exploitation was reported as of the 2026-06-09 disclosure. Defused then reported attacks on all three, and Help Net Security noted Fortinet had not yet confirmed them (Help Net Security, 2026-06-16). CISA added CVE-2026-25089 and CVE-2026-39808 to its Known Exploited Vulnerabilities catalog on 2026-07-16 (CISA KEV catalog, 2026-07-16), while Fortinet's three advisories list none of the flaws as known exploited (Fortinet PSIRT FG-IR-26-141, 2026-06-09) (Fortinet PSIRT FG-IR-26-112, 2026-04-14) (Fortinet PSIRT FG-IR-26-100, 2026-04-14).

Help Net Security describes FortiSandbox as a platform that other Fortinet security products depend on for threat verdicts to enforce blocking decisions and trigger automated responses (Help Net Security, 2026-06-16).

Contradiction: CCB Belgium says a publicly available proof-of-concept exploit raises the likelihood of exploitation (CCB Belgium, 2026-06-11), while Security Affairs reports that a working exploit for CVE-2026-25089 has not been publicly disclosed and that the exploit seen in attacks appears AI-assisted and bugged (Security Affairs, 2026-06-16).