Brief Summary: CVE-2026-25089 — Unauthenticated OS Command Injection in Fortinet FortiSandbox via VNC Feature

Introduction

An unauthenticated OS command injection in Fortinet FortiSandbox's Web UI lets remote attackers execute arbitrary commands on the underlying operating system by sending crafted HTTP requests to the VNC start feature, with no credentials required. The vulnerability is tracked as CVE-2026-25089 and scored 9.8 by the NVD. It affects multiple FortiSandbox deployment models, including on-premises, Cloud, and PaaS variants. Fortinet has published no workarounds, so a firmware upgrade is the only remediation path.

FortiSandbox is Fortinet's dedicated advanced threat detection appliance. It analyzes suspicious files and URLs in a sandboxed environment to identify zero-day malware. In organizations that deploy Fortinet's Security Fabric, it holds a central place in the security stack. A compromise of this appliance gives an attacker code execution on a single host, and it may also undermine the integrity of the threat detection pipeline itself.

Technical Information

Root Cause: Second-Order OS Command Injection (CWE-78)

The Fortinet PSIRT advisory FG-IR-26-141 formally describes CVE-2026-25089 as a "Second-Order OS Command Injection via JSON Input on start vnc feature." The root cause is improper neutralization of special elements (shell metacharacters) in user-supplied JSON input before that input is incorporated into an OS command.

The "second-order" label separates this from a straightforward command injection. In a first-order injection, the vulnerable function executes the malicious input directly, at the point where it receives it. Here, one component of the Web UI stores or processes the attacker's payload, and the payload executes later, when the "start vnc" feature references that stored data to construct an OS command. The injection point and the execution point sit in different code paths and run at different times.

The split affects both detection and exploitation. For detection, standard input validation testing at the HTTP request handler level may not flag the payload as dangerous, because the code path that first receives the input is not the vulnerable one. Real-time monitoring that focuses on the request/response cycle at the injection point will miss the actual command execution, which happens later in the VNC initialization logic.

Attack Flow

From the advisory details, the exploitation chain runs as follows:

1. Reconnaissance: The attacker identifies a network-reachable FortiSandbox Web UI. No authentication is required, so any exposed instance is a valid target.

2. Payload Delivery: The attacker crafts an HTTP request with OS command payloads embedded in JSON parameters tied to the VNC start functionality. These payloads include shell metacharacters that the underlying operating system will interpret.

3. Storage/Processing: The FortiSandbox Web UI processes the JSON input without properly sanitizing the special elements. The malicious data is stored or passed along to the VNC session initialization component.

4. Trigger: When the VNC session initialization logic incorporates the attacker-controlled data into an OS command string, the injected commands execute on the underlying operating system with the privileges of the FortiSandbox service.

5. Impact: The attacker achieves arbitrary command execution on the FortiSandbox appliance. Because FortiSandbox is a security appliance, this could let the attacker manipulate threat analysis results, disable detection capabilities, exfiltrate analyzed samples, or pivot deeper into the network.

The attack runs over the network through the Web UI and requires low complexity, no privileges, and no user interaction. The Fortinet advisory classifies the impact as "Execute unauthorized code or commands."

CVSS Scoring Discrepancy

The CNA-assigned and NVD-published CVSS scores differ. Fortinet assigned CVSSv3 9.1, while the NVD record lists 9.8. The NVD has not yet provided its own independent CVSS vector string assessment. A score of 9.8 corresponds to a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The gap likely comes from how the CNA and NVD rate the impact subscores. Whichever score is ultimately adopted, both fall firmly in the Critical severity range, and the vulnerability should be prioritized accordingly.

Relationship to Other FortiSandbox Vulnerabilities

CVE-2026-25089 is one of several critical FortiSandbox vulnerabilities disclosed in 2026:

• CVE-2026-39808 (FG-IR-26-100): OS command injection through the API endpoint, CVSS 9.1, discovered by Samuel de Lucas Maroto from KPMG Spain
• CVE-2026-26083 (FG-IR-26-136): Missing authorization flaw, CVSS 9.1
• CVE-2026-25836 (FG-IR-26-096): OS command injection in the vmimages update feature (requires authentication)
• CVE-2026-39813: Critical flaw with CVSS 9.8, exploitable without authentication
• CVE-2026-39812 (FG-IR-26-127): Out-of-bounds write in the administrative interface

CWE-78 recurs across multiple FortiSandbox components (Web UI VNC feature, API endpoint, vmimages update). That suggests the weakness in input validation and command construction is systemic in this product line, and that these are not isolated oversights.

Patch Information

Fortinet has released firmware updates that fully address CVE-2026-25089. Fortinet published the official vendor advisory, tracked as FG-IR-26-141, on June 9, 2026. FortiSandbox is a closed-source appliance, so no public source code diff or commit is available. The remediation lives entirely in the proprietary firmware Fortinet distributes. The patched firmware versions sanitize the JSON input path in the VNC start feature, which breaks the second-order injection chain.

The specific fixed versions per product are:

FortiSandbox 4.2 (all versions) is vulnerable but has no listed patch path, which likely means the branch is end of life. Organizations running 4.2 must migrate to a supported release (4.4.9 or higher, or 5.0.6 or higher).

Product branches that are not affected and require no action: FortiSandbox 5.2, FortiSandbox Cloud 5.2, FortiSandbox Cloud 4.4, FortiSandbox PaaS 5.2, FortiSandbox PaaS 4.4, and FortiSandbox PaaS 23.4.

Adham El Karn of Fortinet's Product Security team discovered and reported the vulnerability internally, so the fix was developed proactively, before any known in-the-wild exploitation. Patched firmware is available through Fortinet's standard support and download portal.

No workarounds are available. The Fortinet advisory explicitly provides no workaround for CVE-2026-25089. Organizations that cannot upgrade right away may reduce exposure with compensating controls, such as restricting network access to the FortiSandbox Web UI, deploying a WAF to filter suspicious JSON payloads aimed at VNC endpoints, and monitoring HTTP access logs for anomalous requests. Fortinet does not endorse these measures, and they should be treated as temporary risk reduction only.

Affected Systems and Versions

The following products and version ranges are confirmed vulnerable:

• FortiSandbox (on-premises): Versions 5.0.0 through 5.0.5, versions 4.4.0 through 4.4.8, and all versions of 4.2
• FortiSandbox Cloud: Versions 5.0.4 through 5.0.5
• FortiSandbox PaaS: Versions 5.0.4 through 5.0.5

The following are confirmed not affected:

• FortiSandbox 5.2
• FortiSandbox Cloud 5.2
• FortiSandbox Cloud 4.4
• FortiSandbox PaaS 23.4
• FortiSandbox PaaS 5.2
• FortiSandbox PaaS 4.4

FortiSandbox 4.2 is the worst-off branch. Every version is vulnerable, and no patch is available. The branch appears to have reached end of life, so organizations running it should plan a full migration rather than wait for a fix that is unlikely to arrive.

Vendor Security History

FortiSandbox has had a cluster of critical vulnerabilities in 2026. At least five distinct critical flaws have been disclosed in this product line within a short timeframe. Several belong to the same vulnerability class (CWE-78, OS command injection) and appear in different components: the Web UI VNC feature (CVE-2026-25089), the API endpoint (CVE-2026-39808), and the vmimages update feature (CVE-2026-25836). The others include a missing authorization vulnerability (CVE-2026-26083) and an out-of-bounds write (CVE-2026-39812).

Other Fortinet products are confirmed targets of in-the-wild exploitation. In January 2026, malicious FortiCloud accounts were found actively exploiting the FortiCloud SSO authentication bypass (FG-IR-26-060). That case shows threat actors actively monitor Fortinet advisories and develop exploits for newly disclosed vulnerabilities, sometimes within a narrow window after disclosure.

Fortinet does run an active internal security review process. Adham El Karn of Fortinet's Product Security team discovered CVE-2026-25089, and external researchers such as Samuel de Lucas Maroto from KPMG Spain have also contributed findings. Discovery from both inside and outside the company is a good sign. Still, the same vulnerability class keeps turning up across multiple components, which suggests the FortiSandbox codebase needs deeper architectural changes to input handling and command construction.

References

• NVD: CVE-2026-25089
• Fortinet PSIRT Advisory FG-IR-26-141
• Cybersecurity News: Fortinet FortiSandbox Vulnerability
• Security Affairs: Critical Fortinet Vulnerabilities Fixed in FortiSandbox and FortiAuthenticator
• Greenbone: Fortinet RCE Vulnerabilities in FortiSandbox
• Help Net Security: Fortinet Fixes Critical FortiSandbox Vulnerabilities
• runZero: Find Impacted FortiSandbox Assets
• Singapore CSA Advisory AL-2026-038
• SecurityOnline: Fortinet Critical Alert
• Fortinet PSIRT: FG-IR-26-100 (CVE-2026-39808)
• Cryptika: Fortinet Security Update