VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 04:28 UTC

CVE-2026-25089

Read full description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

CVSS 9.1 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.7/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 9.1: +1.36
Fresh EPSS: 76.11%: +0.38

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 20 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Recorded Future

Press · 07 Aug 2026, 07:00 · July 2026 CVE Landscape - Recorded Future

The Register

Press · 17 Jul 2026, 07:00 · Attackers target critical FortiSandbox flaws as CISA issues patch order - The Register

Infosecurity Magazine

Press · 17 Jul 2026, 07:00 · CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities - Infosecurity Magazine

BleepingComputer

Press · 17 Jul 2026, 07:00 · CISA urges immediate action on actively exploited Fortinet flaws - BleepingComputer

Rescana

Press · 15 Jul 2026, 07:00 · Active Exploitation Alert: Critical Ivanti Sentry and Fortinet Vulnerabilities (CVE-2026-10520) Patched Amid Ongoing Attacks - Rescana

See all 20 source documents

CyberSecurityNews

Press · 14 Jul 2026, 07:00 · FortiSandbox Vulnerability Allows Attackers to Access VNC Servers of VMs - CyberSecurityNews

SOCRadar

Press · 17 Jun 2026, 07:00 · FortiSandbox Vulnerabilities Expose Systems to Auth Bypass and Command Execution - SOCRadar

CyberScoop

Press · 17 Jun 2026, 07:00 · Attackers hit pair of critical Fortinet vulnerabilities the vendor disclosed in April - CyberScoop

SecurityWeek

Press · 17 Jun 2026, 07:00 · 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs - SecurityWeek

Press · 16 Jun 2026, 07:00 · Threat Actors Actively Exploit Multiple Critical Fortinet FortiSandbox Vulnerabilities - LinkedIn

The Hacker News

Press · 16 Jun 2026, 07:00 · Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week - The Hacker News

CyberSecurityNews

Press · 16 Jun 2026, 07:00 · Critical Fortinet FortiSandbox Vulnerabilities Actively Exploited in Attacks - CyberSecurityNews

BleepingComputer

Press · 16 Jun 2026, 07:00 · Critical Fortinet FortiSandbox flaws now exploited in attacks - BleepingComputer

Help Net Security

Press · 16 Jun 2026, 07:00 · Attackers are exploiting FortiSandbox vulnerabilities - Help Net Security

Arctic Wolf

Press · 15 Jun 2026, 07:00 · CVE-2026-25089: Fortinet FortiSandbox Critical OS Command Injection Vulnerability Immediate Action Required - Arctic Wolf

CCB Belgium

Press · 11 Jun 2026, 07:00 · Warning: Fortinet Addresses a Critical Command Injection Vulnerability in FortiSandbox, patch immediately! - CCB Belgium

Security Affairs

Press · 11 Jun 2026, 07:00 · Fortinet patched a new critical FortiSandbox flaw - Security Affairs

The Hacker News

Press · 10 Jun 2026, 07:00 · Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities - The Hacker News

SecurityWeek

Press · 10 Jun 2026, 07:00 · Critical Vulnerabilities Patched in Fortinet, Ivanti Products - SecurityWeek

CyberSecurityNews

Press · 09 Jun 2026, 07:00 · Fortinet FortiSandbox Vulnerability Allows Attackers to Execute Unauthorized Commands - CyberSecurityNews

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 9.1; EPSS 76.1%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:03.483954+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

09 Jun 2026, 07:00

Published

09 Jun 2026, 14:27

Added to the CISA KEV catalog

16 Jul 2026, 00:00

Latest press mention

07 Aug 2026, 07:00

Score calculated

05 Nov 2026, 14:00