CVE-2026-25089Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC available

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud …

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score94/ 100 · Severe

impact 53.9 · likelihood 15.2 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jun 9, 2026

Updated

Jul 16, 2026

CVSS

9.8

Vendor

fortinet

Product

fortisandbox

CWE

CWE-78

Depth score

94 · Severe

EPSS

76% · p100

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

GitHub PoCs

2 public repositories

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

70% → 76%▲ 6.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 92 days

Jun 9, 2026Published
Disclosed via NVD
Jul 16, 2026Record revised
Last analysed / modified upstream
Jul 16, 2026Added to CISA KEV
Federal remediation due Jul 19, 2026
Jul 30, 2026EPSS first tracked
70%
Aug 24, 2026EPSS peak
70% → 76%
Sep 8, 2026Public exploit observed
2 GitHub repos

fortinet CWE-78 #nvd #kev #in-the-wild #exploit-available

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Jul 16, 2026. Federal remediation due Jul 19, 2026. View catalog ↗

Affected

fortisandbox >= 4.2.0, <= 4.2.8
fortisandbox >= 4.4.0, < 4.4.9
fortisandbox >= 5.0.0, < 5.0.6
fortisandbox_cloud >= 5.0.4, < 5.0.6
fortisandbox_paas >= 5.0.4, < 5.0.6

Patched in

fortisandbox 5.0.6
fortisandbox_cloud 5.0.6
fortisandbox_paas 5.0.6

Full technical detail▾

Overview

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Affected

fortisandbox >= 4.2.0, <= 4.2.8
fortisandbox >= 4.4.0, < 4.4.9
fortisandbox >= 5.0.0, < 5.0.6
fortisandbox_cloud >= 5.0.4, < 5.0.6
fortisandbox_paas >= 5.0.4, < 5.0.6

Remediation

Upgrade past the affected range:

fortisandbox 5.0.6
fortisandbox_cloud 5.0.6
fortisandbox_paas 5.0.6

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Jul 24, 2026EPSS 36% → 70%
Jul 17, 2026EPSS 23% → 36%

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available

← Back to feed

CVE-2026-25089Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC available

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud …

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score94/ 100 · Severe

impact 53.9 · likelihood 15.2 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jun 9, 2026

Updated

Jul 16, 2026

CVSS

9.8

Vendor

fortinet

Product

fortisandbox

CWE

CWE-78

Depth score

94 · Severe

EPSS

76% · p100

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

GitHub PoCs

2 public repositories

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

70% → 76%▲ 6.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 92 days

Jun 9, 2026Published
Disclosed via NVD
Jul 16, 2026Record revised
Last analysed / modified upstream
Jul 16, 2026Added to CISA KEV
Federal remediation due Jul 19, 2026
Jul 30, 2026EPSS first tracked
70%
Aug 24, 2026EPSS peak
70% → 76%
Sep 8, 2026Public exploit observed
2 GitHub repos

fortinet CWE-78 #nvd #kev #in-the-wild #exploit-available

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Jul 16, 2026. Federal remediation due Jul 19, 2026. View catalog ↗

Affected

fortisandbox >= 4.2.0, <= 4.2.8
fortisandbox >= 4.4.0, < 4.4.9
fortisandbox >= 5.0.0, < 5.0.6
fortisandbox_cloud >= 5.0.4, < 5.0.6
fortisandbox_paas >= 5.0.4, < 5.0.6

Patched in

fortisandbox 5.0.6
fortisandbox_cloud 5.0.6
fortisandbox_paas 5.0.6

Full technical detail▾

Overview

Affected

fortisandbox >= 4.2.0, <= 4.2.8
fortisandbox >= 4.4.0, < 4.4.9
fortisandbox >= 5.0.0, < 5.0.6
fortisandbox_cloud >= 5.0.4, < 5.0.6
fortisandbox_paas >= 5.0.4, < 5.0.6

Remediation

Upgrade past the affected range:

fortisandbox 5.0.6
fortisandbox_cloud 5.0.6
fortisandbox_paas 5.0.6

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published
Jul 24, 2026EPSS 36% → 70%
Jul 17, 2026EPSS 23% → 36%

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available