Brief Summary: CVE-2026-25089 — Unauthenticated OS Command Injection in Fortinet FortiSandbox via VNC Feature

Introduction

An unauthenticated OS command injection in Fortinet FortiSandbox's Web UI allows remote attackers to execute arbitrary commands on the underlying operating system by sending crafted HTTP requests to the VNC start feature, with no credentials required. The vulnerability, tracked as CVE-2026-25089 and scored 9.8 by the NVD, affects multiple FortiSandbox deployment models including on-premises, Cloud, and PaaS variants, and Fortinet has published no workarounds, making firmware upgrades the only remediation path.

FortiSandbox is Fortinet's dedicated advanced threat detection appliance, designed to analyze suspicious files and URLs in a sandboxed environment to identify zero-day malware. It occupies a critical position in the security stack of organizations that deploy Fortinet's Security Fabric, meaning a compromise of this appliance does not just grant code execution on a single host; it potentially undermines the integrity of the threat detection pipeline itself.

Technical Information

Root Cause: Second-Order OS Command Injection (CWE-78)

CVE-2026-25089 is formally described in the Fortinet PSIRT advisory FG-IR-26-141 as a "Second-Order OS Command Injection via JSON Input on start vnc feature." The root cause is improper neutralization of special elements (shell metacharacters) in user-supplied JSON input before that input is incorporated into an OS command.

The "second-order" designation is a critical technical distinction that differentiates this from a straightforward command injection. In a first-order injection, the malicious input is directly executed by the vulnerable function at the point of receipt. Here, the attacker's payload is stored or processed by one component of the Web UI and later executed when the "start vnc" feature references that stored data to construct an OS command. The injection point and the execution point are in different code paths, separated temporally.

This has practical implications for both detection and exploitation. From a detection standpoint, standard input validation testing at the HTTP request handler level may not flag the payload as dangerous, because the vulnerable code path is not the one that initially receives the input. Real-time monitoring that focuses on the request/response cycle at the injection point will miss the actual command execution, which occurs later in the VNC initialization logic.

Attack Flow

Based on the advisory details, the exploitation chain proceeds as follows:

1. Reconnaissance: The attacker identifies a network-reachable FortiSandbox Web UI. No authentication is required, so any exposed instance is a valid target.

2. Payload Delivery: The attacker crafts an HTTP request containing OS command payloads embedded within JSON parameters associated with the VNC start functionality. These payloads include shell metacharacters that will be interpreted by the underlying operating system.

3. Storage/Processing: The FortiSandbox Web UI processes the JSON input without properly sanitizing the special elements. The malicious data is stored or passed along to the VNC session initialization component.

4. Trigger: When the VNC session initialization logic incorporates the attacker-controlled data into an OS command string, the injected commands execute with the privileges of the FortiSandbox service on the underlying operating system.

5. Impact: The attacker achieves arbitrary command execution on the FortiSandbox appliance. Given FortiSandbox's role as a security appliance, this could enable the attacker to manipulate threat analysis results, disable detection capabilities, exfiltrate analyzed samples, or pivot deeper into the network.

The attack vector is network-based through the Web UI, requires low complexity, no privileges, and no user interaction. The Fortinet advisory classifies the impact as "Execute unauthorized code or commands."

CVSS Scoring Discrepancy

There is a notable discrepancy between the CNA-assigned and NVD-published CVSS scores. Fortinet assigned CVSSv3 9.1, while the NVD record lists 9.8. The NVD has not yet provided its own independent CVSS vector string assessment. A score of 9.8 corresponds to a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The difference likely stems from how the CNA and NVD rate the impact subscores. Regardless of which score is ultimately adopted, both place this firmly in the Critical severity range and should be treated accordingly for prioritization purposes.

Relationship to Other FortiSandbox Vulnerabilities

CVE-2026-25089 is not an isolated finding. It is part of a broader pattern of critical FortiSandbox vulnerabilities disclosed in 2026:

• CVE-2026-39808 (FG-IR-26-100): OS command injection through the API endpoint, CVSS 9.1, discovered by Samuel de Lucas Maroto from KPMG Spain
• CVE-2026-26083 (FG-IR-26-136): Missing authorization flaw, CVSS 9.1
• CVE-2026-25836 (FG-IR-26-096): OS command injection in the vmimages update feature (requires authentication)
• CVE-2026-39813: Critical flaw with CVSS 9.8, exploitable without authentication
• CVE-2026-39812 (FG-IR-26-127): Out-of-bounds write in the administrative interface

The recurrence of CWE-78 across multiple FortiSandbox components (Web UI VNC feature, API endpoint, vmimages update) suggests that input validation and command construction patterns are systemically weak in this product line, rather than being isolated oversights.

Patch Information

Fortinet has released firmware updates that fully address CVE-2026-25089. The official vendor advisory, tracked as FG-IR-26-141, was published on June 9, 2026. Because FortiSandbox is a closed-source appliance, no public source code diff or commit is available; the remediation is entirely within the proprietary firmware distributed by Fortinet. The patched firmware versions sanitize the JSON input path in the VNC start feature, preventing the second-order injection chain.

The specific fixed versions per product are:

FortiSandbox 4.2 (all versions) is vulnerable but has no listed patch path, indicating this branch is likely end of life. Organizations running 4.2 must migrate to a supported release (4.4.9 or higher, or 5.0.6 or higher).

Product branches that are not affected and require no action: FortiSandbox 5.2, FortiSandbox Cloud 5.2, FortiSandbox Cloud 4.4, FortiSandbox PaaS 5.2, FortiSandbox PaaS 4.4, and FortiSandbox PaaS 23.4.

The vulnerability was internally discovered and reported by Adham El Karn of Fortinet's Product Security team, meaning the fix was developed proactively before any known in-the-wild exploitation. Patched firmware is available through Fortinet's standard support and download portal.

No workarounds are available. The Fortinet advisory explicitly provides no workaround for CVE-2026-25089. For organizations that cannot immediately upgrade, compensating controls such as restricting network access to the FortiSandbox Web UI, deploying a WAF to filter suspicious JSON payloads targeting VNC endpoints, and monitoring HTTP access logs for anomalous requests may reduce exposure. These measures are not vendor-endorsed and should be treated as temporary risk reduction only.

Affected Systems and Versions

The following products and version ranges are confirmed vulnerable:

• FortiSandbox (on-premises): Versions 5.0.0 through 5.0.5, versions 4.4.0 through 4.4.8, and all versions of 4.2
• FortiSandbox Cloud: Versions 5.0.4 through 5.0.5
• FortiSandbox PaaS: Versions 5.0.4 through 5.0.5

The following are confirmed not affected:

• FortiSandbox 5.2
• FortiSandbox Cloud 5.2
• FortiSandbox Cloud 4.4
• FortiSandbox PaaS 23.4
• FortiSandbox PaaS 5.2
• FortiSandbox PaaS 4.4

FortiSandbox 4.2 is in a particularly critical position: all versions are vulnerable, and no patch is available. This branch appears to have reached end of life, and organizations running it should plan a full migration rather than waiting for a fix that is unlikely to arrive.

Vendor Security History

Fortinet's FortiSandbox has experienced a significant concentration of critical vulnerabilities in 2026. At least five distinct critical flaws have been disclosed in this product line within a short timeframe, with multiple instances of the same vulnerability class (CWE-78, OS command injection) appearing across different components: the Web UI VNC feature (CVE-2026-25089), the API endpoint (CVE-2026-39808), and the vmimages update feature (CVE-2026-25836). Additional flaws include a missing authorization vulnerability (CVE-2026-26083) and an out-of-bounds write (CVE-2026-39812).

Beyond FortiSandbox, Fortinet products have been confirmed targets for in-the-wild exploitation. The FortiCloud SSO authentication bypass (FG-IR-26-060) was found being actively exploited by malicious FortiCloud accounts in January 2026. This broader context is relevant because it demonstrates that threat actors actively monitor Fortinet advisories and develop exploits for newly disclosed vulnerabilities, sometimes within a narrow window after disclosure.

Fortinet does maintain an active internal security review process. CVE-2026-25089 was discovered by Adham El Karn of Fortinet's Product Security team, and external researchers such as Samuel de Lucas Maroto from KPMG Spain have also contributed findings. The combination of internal and external discovery is a positive indicator, though the recurring nature of the same vulnerability class across multiple components suggests that deeper architectural changes to input handling and command construction may be needed in the FortiSandbox codebase.

References

• NVD: CVE-2026-25089
• Fortinet PSIRT Advisory FG-IR-26-141
• Cybersecurity News: Fortinet FortiSandbox Vulnerability
• Security Affairs: Critical Fortinet Vulnerabilities Fixed in FortiSandbox and FortiAuthenticator
• Greenbone: Fortinet RCE Vulnerabilities in FortiSandbox
• Help Net Security: Fortinet Fixes Critical FortiSandbox Vulnerabilities
• runZero: Find Impacted FortiSandbox Assets
• Singapore CSA Advisory AL-2026-038
• SecurityOnline: Fortinet Critical Alert
• Fortinet PSIRT: FG-IR-26-100 (CVE-2026-39808)
• Cryptika: Fortinet Security Update