highclosedpatched

Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerability

› Fortinet FortiSandbox

last updated Jul 16, 2026

Get an email when a new major security incident drops. No spam, unsubscribe any time.

started: Jul 16, 2026
closed: Jul 16, 2026
CVEs: 2
sources: 5

## summary

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA added CVE-2026-25089, CVE-2026-39808 to the Known Exploited Vulnerabilities catalog on 2026-07-16 based on evidence of active exploitation.

severity: Actively exploited (CISA KEV)

## cve ids[2]

CVE-2026-25089 CVE-2026-39808

## affected

See vendor advisory / CISA notes (versions not always listed in KEV feed)

## fixed in

See vendor advisory linked in sources

## timeline[1]

Jul 16, 2026
CISA added CVE-2026-25089, CVE-2026-39808 to the KEV catalog (due 2026-07-19).

## advisories[5]

## notes & caveats

Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier).

Get notified