Critical FortiSandbox Flaw Allows Remote Command Execution

Fortinet has recently announced a critical security flaw in its FortiSandbox series, posing significant risks by allowing remote attackers to execute unauthorized commands through its web interface without needing authentication.

Understanding the Vulnerability

The vulnerability, identified as CVE-2026-25089 with a CVSSv3 score of 9.1, is due to improper neutralization of special elements used in OS commands, commonly referred to as OS command injection. This flaw affects various versions of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS deployments.

Attackers can exploit this vulnerability by sending tailored HTTP requests, which enable the execution of unauthorized commands on the system. The absence of an authentication requirement makes exploiting this flaw relatively straightforward while posing a substantial threat to system integrity and confidentiality.

Impacted Versions and Mitigation

The affected versions include FortiSandbox 5.0.0 to 5.0.5, FortiSandbox Cloud 5.0.4 to 5.0.5, and FortiSandbox PaaS 5.0.4 to 5.0.5, with updates available to versions 5.0.6 or 4.4.9 and above. Notably, FortiSandbox versions 5.2 and others listed remain unaffected by this flaw.

Discovered by Adham El Karn from Fortinet’s Product Security team, the advisory was published on June 9, 2026. The criticality of the vulnerability, coupled with the absence of active exploitation reports, underscores the need for immediate action.

Recommendations for Enterprises

Enterprises using FortiSandbox are urged to upgrade to the latest secure versions immediately. It is also recommended to restrict web UI access to trusted IP ranges and to monitor logs for unusual HTTP requests targeting the FortiSandbox interface.

Given its deployment in enterprise environments for malware analysis and threat detection, a breach could severely compromise an organization’s security infrastructure, granting attackers a strategic advantage.

Conclusion and Future Outlook

While no active exploits have been reported, the zero-authentication vulnerability makes this a high-priority issue for security teams. Organizations are encouraged to prioritize patching and follow Fortinet’s advisory for comprehensive guidance to safeguard their systems.