CVE-2026-25089: OS Command Injection in Fortinet FortiSandbox (KEV, Actively Exploited)

What the vulnerability is

CVE-2026-25089 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox. Crafted input to a vulnerable API or web management endpoint is passed unsanitized into an OS-level command, letting an authenticated or, depending on exposure, remote attacker execute arbitrary commands on the underlying operating system. Successful exploitation can lead to full host compromise of the sandbox appliance, including access to any samples, credentials, or network segments it can reach.

Affected software

The vulnerability affects Fortinet FortiSandbox. No specific affected version range has been published in the source data for this detection; organizations running FortiSandbox should treat all deployments as potentially in scope until Fortinet's advisory confirms otherwise.

Exploitation status

CVE-2026-25089 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active, real-world exploitation, and it falls under CISA BOD 26-04 prioritized remediation timelines for federal agencies. For defenders, KEV status means this is not theoretical risk assessment — attackers are already using it, and patching/mitigation should be treated as urgent, with detection coverage deployed as an immediate compensating control while remediation is completed.

How our detection catches it

Our detection logic targets the exploitation chain rather than a single signature, looking for:

• Anomalous shell or process execution spawned from FortiSandbox web/management processes
• Suspicious HTTP requests containing shell metacharacters directed at FortiSandbox management interfaces
• Post-exploitation command execution artifacts consistent with a successful injection

This coverage is shipped across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL), so teams can deploy behavior-based detection regardless of which SIEM or EDR stack they run, without relying solely on patch status.

Get the full detection

For the complete detection logic, platform-specific queries, and coverage details, see the full CVE-2026-25089 detection page.