FortiSandbox unauth RCE (CVE-2026-25089) [PoC]
CVE-2026-25089
CVE-2026-25089: critical unauthenticated OS command injection in FortiSandbox 5.0.x/4.4.x/4.2.x allows remote code execution. Update to patched versions per vendor advisory.
Patch now - CVE-2026-25089 is a critical OS command injection vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, and 4.2 all versions that allows an unauthenticated attacker to execute arbitrary commands via crafted HTTP requests. Vendor patches are available; upgrade immediately.
Overview
CVE-2026-25089 is an improper neutralization of special elements used in an OS command vulnerability (OS command injection) affecting Fortinet FortiSandbox on-premises, FortiSandbox Cloud, and FortiSandbox PaaS. The flaw resides in how the product handles HTTP requests, allowing an attacker with network access to inject system-level commands without any authentication.
Impact
A successful exploit enables an unauthenticated remote attacker to execute arbitrary OS commands on the affected FortiSandbox appliance. This can lead to full system compromise, data exfiltration, lateral movement within the network, and potential disruption of sandboxing services. The vulnerability carries a CVSS score of 9.8 (Critical) due to its low attack complexity, no required privileges, and no user interaction.
Affected Versions
- FortiSandbox: 5.0.0 through 5.0.5
- FortiSandbox: 4.4.0 through 4.4.8
- FortiSandbox: 4.2 all versions
- FortiSandbox Cloud: 5.0.4 through 5.0.5
- FortiSandbox PaaS: 5.0.4 through 5.0.5
Remediation and Mitigation
Fortinet has released fixed versions to address CVE-2026-25089. Organizations should take the following actions:
- Upgrade immediately: Update FortiSandbox to the latest patched version as specified in the Fortinet security advisory.
- Restrict network access: If immediate patching is not possible, limit access to the FortiSandbox management interface to trusted IP addresses only.
- Monitor for suspicious activity: Review logs for unexpected HTTP requests or unusual system command execution.
Related Threats
The exploitation of Fortinet products remains a common vector for threat actors. Recent campaigns have demonstrated adversaries targeting Fortinet appliances for initial access and credential theft. For broader context on current threats, see the Weekly Threat Roundup: Nx Console Supply Chain Attack (May 25-31), reports of Threat Actors Exploit Critical FortiClient EMS Flaw to, and the CyberStrikeAI tool adopted by hackers for AI-powered attacks.
Security Insight
This vulnerability falls into a pattern of critical OS command injection flaws in security appliances. Fortinet has had multiple similar issues in recent years, which suggests a systemic need to shift from manual input validation to parameterized APIs and allowlisting of system commands. Organizations running FortiSandbox in air-gapped or sensitive environments should treat this as a priority patch, as the lack of authentication requirements means internet-exposed instances are trivially exploitable.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| HORKimhab/CVE-2026-25089 CVE-2026-25089 - Draft - Fortinet FortiSandbox | ★ 0 |
Showing 1 of 1 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull...
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code ...
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper execution where helper configuration values are executed using shell=true without ...
PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_pro...