CVE-2026-25089KEV · OVERDUECWE-78

Fortinet FortiSandbox OS Command Injection Vulnerability

Critical · published June 9, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.1. It is confirmed in active exploitation. It sits in the 99.5th percentile for exploit probability.

97
days past CISA
deadline
CVSS v3.1
9.1
EPSS
76%
Percentile
99.5
In the wild
Confirmed
What it is

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.76112 · 99.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-09T14:27Z
KEV added
2026-07-16 · due 2026-07-19
EPSS history
Timeline
  • 16 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 19
    kev
  • 09 JUN 14:27Z
    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5…
    cvelistv5