Fortinet FortiSandbox Vulnerabilities Exploited: CVE-2026-25089, CVE-2026-39808
Fortinet FortiSandbox has confirmed OS command injection vulnerabilities that allow unauthenticated remote code execution. Upgrade to the latest version to mitigate risk.
What happened
Fortinet FortiSandbox contains an OS command injection vulnerability (CVE-2026-25089) that allows unauthenticated attackers to execute unauthorized code via crafted HTTP requests. This flaw affects versions 4.2.x, 4.4.0–4.4.8, 5.0.0–5.0.5; Cloud 5.0.4–5.0.5; PaaS 5.0.4–5.0.5. It has been actively exploited since mid-June 2026. A related flaw (CVE-2026-39808) was also exploited in the wild. To resolve these issues, admins must upgrade to FortiSandbox 4.4.9+, 5.0.6+; Cloud/PaaS 5.0.6+.
CISA has added CVE-2026-25089 to its Known Exploited Vulnerabilities catalog and urges immediate patching. FCEB agencies have a July 19, 2026 deadline to apply updates. To assess your exposure, check if you are running an affected version of FortiSandbox. If so, upgrade to the latest version immediately. Review firewall rules to prevent unauthorized access to the FortiSandbox web interface.
How 0Day mitigates this
fortisandbox is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.