Fortinet FortiSandbox OS Command Injection (CVE-2026-25089)

// Requires firewall/network device logs or FortiSandbox syslog forwarded via CEF/Syslog connector into a custom table (FortiSandboxCL) or CommonSecurityLog
let susPatterns = dynamic([";", "|", "&&", "$(", "`", "wget ", "curl ", "/bin/sh", "/bin/bash", "nc ", "chmod +x"]);
CommonSecurityLog
| where DeviceVendor == "Fortinet" and DeviceProduct has "FortiSandbox"
| where isnotempty(RequestURL) or isnotempty(Message)
| extend RawContent = strcat(tostring(RequestURL), " ", tostring(Message))
| where susPatterns has_any (RawContent)
| extend MatchedPattern = extract_all(@"(;|\||&&|\$\(|`|wget |curl |/bin/sh|/bin/bash|nc |chmod \+x)", RawContent)
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, Message, MatchedPattern
| sort by TimeGenerated desc

index=network sourcetype=fortinet:fortisandbox OR sourcetype=cef
(dvc_vendor="Fortinet" OR vendor="Fortinet") (product="FortiSandbox" OR dvc_product="FortiSandbox")
| eval raw_content=coalesce(request_url, uri_path, _raw)
| regex raw_content="(;|\||&&|\$\(|`|wget\s|curl\s|/bin/sh|/bin/bash|nc\s|chmod\s\+x)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, raw_content
| where count > 0
| sort -last_seen

any where event.dataset in ("fortinet.fortisandbox", "network.http") and
  (url.original : ("*;*", "*|*", "*&&*", "*$(*", "*`*", "*wget*", "*curl*", "*chmod +x*") or
   http.request.body.content : ("*;*", "*|*", "*&&*", "*$(*", "*`*", "*wget*", "*curl*", "*chmod +x*")) and
  destination.ip != null

SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, URL, "Log Source", payload
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Fortinet%'
AND (URL IMATCHES '.*(;|\\||&&|\\$\\(|`|wget |curl |chmod \\+x).*' OR UTF8(payload) IMATCHES '.*(;|\\||&&|\\$\\(|`|/bin/sh|/bin/bash).*')
LAST 24 HOURS

_sourceCategory=*fortinet* OR _sourceCategory=*fortisandbox*
| parse regex "(?<url_path>(?:GET|POST)\s+\S+)" nodrop
| where url_path matches "*;*" or url_path matches "*|*" or url_path matches "*&&*" or url_path matches "*$(*" or url_path matches "*wget*" or url_path matches "*curl*" or url_path matches "*chmod +x*"
| count by url_path, sourceHost
| sort by _count desc

rule fortisandbox_cmd_injection_cve_2026_25089 {
  meta:
    author = "df00tech"
    description = "Detects potential OS command injection exploitation attempts against Fortinet FortiSandbox (CVE-2026-25089)"
    severity = "CRITICAL"
    reference = "https://fortiguard.fortinet.com/psirt/FG-IR-26-141"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.application = "FortiSandbox"
    re.regex($e.network.http.request_url, `(;|\||&&|\$\(|` + "`" + `|wget |curl |chmod \+x|/bin/sh|/bin/bash)`)

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| in(field=ParentBaseFileName, values=["httpd", "nginx", "apache2", "fsa_httpd", "cmdbsvr"], ignoreCase=true)
| in(field=FileName, values=["sh", "bash", "wget", "curl", "nc", "chmod", "python", "perl"], ignoreCase=true)
| table([_time, aid, ComputerName, ParentBaseFileName, FileName, CommandLine])
| sort(_time, order=desc)