CISA Adds Fortinet FortiSandbox OS Command Injection to KEV Catalog

CISA has officially added CVE-2026-25089, a critical OS command injection vulnerability affecting Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS, to its Known Exploited Vulnerabilities (KEV) catalog. Because this flaw allows unauthenticated attackers to execute unauthorized commands via specifically crafted HTTP requests, federal agencies are required to apply necessary mitigations by July 19, 2026.

What's at Risk

The vulnerability impacts Fortinet FortiSandbox, including its cloud and PaaS deployments. Organizations utilizing these products, particularly those with internet-facing instances, are at the highest risk of compromise. Because the flaw can be triggered by unauthenticated actors, any system exposed to the public network without proper access controls or current security updates is a potential target for exploitation.

How the Flaw Works

This vulnerability is classified as CWE-78, which refers to OS Command Injection. In general terms, this class of weakness occurs when an application fails to properly sanitize user-supplied input before passing it to a system shell or command-line interface. When an application is vulnerable to this type of flaw, an attacker can typically inject their own malicious commands into the system's execution stream. This allows the attacker to bypass standard application logic and execute arbitrary code with the privileges of the service running the application, potentially leading to a full system takeover, data exfiltration, or the installation of persistent malware.

How to Protect Your Systems

• Immediately apply all vendor-provided mitigations or patches in accordance with Fortinet's official guidance.
• Ensure full compliance with CISA BOD 26-04 by prioritizing the remediation of this specific asset by the July 19, 2026, deadline.
• Evaluate the internet exposure of all affected assets and restrict access to authorized management interfaces only.
• Implement network segmentation to contain potential breaches and limit lateral movement within the environment.
• Continuously monitor system logs for suspicious HTTP requests or unexpected command-line activity that could indicate an attempted exploit.
• If formal mitigations are unavailable for specific cloud-based deployments, consider discontinuing use of the product until a secure patch is verified.

The addition of this vulnerability to the KEV catalog underscores the immediate danger posed by active exploitation in the wild. Organizations must treat this as a high-priority incident, as the ability for an unauthenticated attacker to inject commands represents a significant breach of the security perimeter. Adhering to the mandated timelines and hardening best practices is essential to preventing unauthorized system access and maintaining operational integrity.