CVE-2026-25089 in Fortinet FortiSandbox: active exploitation confirmed, patch now and lock down access

Fortinet’s FortiSandbox has a critical web UI flaw, CVE-2026-25089, that government and enterprise defenders should treat as an immediate priority. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. federal agencies to remediate on short timelines. Independent reporting also notes related FortiSandbox issues under attack.

Why it matters

FortiSandbox feeds verdicts and automation decisions to other Fortinet products (such as FortiGate, FortiMail, FortiWeb, and FortiProxy). A compromise here can ripple outward, distorting security outcomes across the environment. The vulnerability is remotely exploitable without authentication or user interaction, making exposed management interfaces particularly risky.

What we know

According to Fortinet’s CNA record and public advisories referenced in coverage, CVE-2026-25089 is an OS command injection in the FortiSandbox web interface. Reports indicate it affects the “start VNC” feature and can be triggered via crafted HTTP requests, enabling remote code execution with low complexity and no user action. Fortinet’s CNA record lists a CVSS score of 9.8 (Critical), while the Fortinet PSIRT advisory lists 9.1; NVD had not yet published an independent assessment at the time of the cited reporting.

• CISA added CVE-2026-25089 to the KEV on July 16, 2026, citing active exploitation and directing federal agencies to patch by July 19 under BOD 26-04. [Source: BleepingComputer]
• Threat intelligence sources observed exploitation attempts against FortiSandbox vulnerabilities in mid-June. [Source: BleepingComputer; RECON blog]
• Two related FortiSandbox issues have also been highlighted: CVE-2026-39808 (OS command injection) and CVE-2026-39813 (path traversal/authentication bypass). Public reporting ties both to exploitation activity in the same timeframe, with fixes issued in April. [Source: BleepingComputer; RECON blog]

Fortinet advisories for these issues were published earlier in the year, with updates in April and June. [Source: BleepingComputer; Fortinet PSIRT]

Affected and fixed versions (as reported)

Evidence compiled in the RECON write-up attributes the following scope to CVE-2026-25089:

Affected:

• FortiSandbox 4.2.x (all versions)
• FortiSandbox 4.4.0–4.4.8
• FortiSandbox 5.0.0–5.0.5
• FortiSandbox Cloud 5.0.4–5.0.5
• FortiSandbox PaaS 5.0.4–5.0.5

Fixed:

• FortiSandbox 4.4.9 and later
• FortiSandbox 5.0.6 and later
• FortiSandbox Cloud/PaaS 5.0.6 and later

Note: The CNA record lists 4.2 as affected, but the Fortinet PSIRT advisory cited in the evidence does not provide a 4.2 remediation path. The RECON post recommends contacting Fortinet for migration guidance.

Related FortiSandbox CVEs from the same reporting:

• CVE-2026-39808 — OS command injection; unauthenticated RCE (patched in April)
• CVE-2026-39813 — Path traversal leading to authentication bypass (patched in April)

Practical steps supported by the evidence

• Patch immediately: upgrade to FortiSandbox 4.4.9+ or 5.0.6+. For Cloud/PaaS, move to 5.0.6+.
• Address the related flaws: verify updates covering CVE-2026-39808 and CVE-2026-39813 are applied.
• Restrict management access: ensure the FortiSandbox web UI is not internet-facing. Limit access to dedicated management networks or jump hosts with MFA.
• Review downstream integrations: because FortiSandbox verdicts influence FortiGate, FortiMail, FortiWeb, and FortiProxy, check for unexpected verdicts, signatures, or configuration changes.
• Hunt carefully for anomalies: the RECON post notes no validated, vendor-provided IOCs for this bug. As general hygiene, review web UI access logs for unusual requests to VNC-related endpoints, look for unexpected outbound connections, newly created admin users, or modified system settings.

If you cannot patch immediately, isolate the management interface from untrusted networks and enforce strict allow-listing for administrative access, as suggested by the RECON guidance.

What’s still unclear

Some details remain in flux:

• Fortinet’s advisory reportedly lists a different CVSS than the CNA record, and NVD had not yet published its own assessment in the cited sources.
• The PSIRT advisory referenced in the reporting does not include a remediation path for 4.2.x, despite 4.2 being listed as affected in the CNA record. Organizations running 4.2 should consult Fortinet for supported migration options.
• BleepingComputer notes that, at publication time, Fortinet had not tagged the two main issues as exploited in its advisories, though CISA has confirmed in-the-wild exploitation by listing CVE-2026-25089 in KEV and directing urgent patching.

Bottom line

Treat CVE-2026-25089 as a high-priority, actively exploited FortiSandbox issue. Patch to the fixed releases, restrict management exposure, and review connected Fortinet workflows for any knock-on effects. Given the role FortiSandbox plays across Fortinet ecosystems—and the presence of two related FortiSandbox CVEs in recent exploitation reports—completeness and speed matter here.

References:

• CISA directive and exploitation confirmation: BleepingComputer — “CISA urges immediate action on actively exploited Fortinet flaws” https://www.bleepingcomputer.com/news/security/cisa-warns-feds-to-patch-exploited-fortinet-fortisandbox-flaws-by-sunday/
• Vendor advisory: Fortinet PSIRT FG-IR-26-141 https://fortiguard.fortinet.com/psirt/FG-IR-26-141
• Technical scope and version detail: RECON blog — “CVE-2026-25089: Fortinet FortiSandbox Unauthenticated OS Command Injection” https://hellorecon.com/blog/cve-2026-25089
• CVE entries: NVD CVE-2026-25089 https://nvd.nist.gov/vuln/detail/CVE-2026-25089, CVE-2026-39808 https://nvd.nist.gov/vuln/detail/CVE-2026-39808, CVE-2026-39813 https://nvd.nist.gov/vuln/detail/CVE-2026-39813

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.