CISA Flags Actively Exploited Fortinet FortiSandbox Injection Flaw

CISA has officially added CVE-2026-25089, an OS command injection vulnerability affecting Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS, to its Known Exploited Vulnerabilities (KEV) catalog. Because this flaw allows unauthenticated attackers to execute unauthorized commands via specifically crafted HTTP requests, it poses an immediate risk to any organization running these services, necessitating urgent remediation by the federal deadline of July 19, 2026.

What's at Risk

The vulnerability impacts Fortinet FortiSandbox across its on-premises, cloud, and PaaS deployments. Organizations utilizing these products, particularly those with internet-facing instances, are at the highest risk of compromise. Because the vulnerability does not require authentication, attackers can potentially gain unauthorized access to the underlying operating system of the sandbox appliance without needing valid credentials.

How the Flaw Works

This vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command. In general terms, this class of weakness occurs when an application fails to properly sanitize user-supplied input before passing it to a system shell or command-line interface. When an attacker provides malicious input, the application may inadvertently execute that input as a system command with the privileges of the application process. This typically allows an attacker to bypass security controls, read sensitive data, modify system configurations, or install additional malicious software, effectively granting them control over the affected server.

How to Protect Your Systems

• Immediately apply the latest security patches provided by Fortinet in accordance with their official guidance.
• Ensure full compliance with CISA’s BOD 26-04 requirements, including the July 19, 2026, remediation deadline for all affected assets.
• Evaluate the internet exposure of all FortiSandbox instances and restrict access to authorized management networks or VPNs where possible.
• Follow CISA’s “Forensics Triage Requirements” to monitor logs for indicators of compromise or unauthorized access attempts.
• Implement network segmentation to isolate sandboxing infrastructure from sensitive internal corporate resources.
• Regularly audit system configurations and apply vendor-recommended hardening guides to minimize the attack surface of network appliances.

The inclusion of this vulnerability in the KEV catalog confirms that threat actors are actively seeking to weaponize this flaw against vulnerable infrastructure. Given the potential for unauthenticated remote code execution, organizations must prioritize patching these systems immediately. Failing to address this vulnerability within the specified timeframe leaves critical security infrastructure open to exploitation, potentially granting attackers a foothold within the network that could be leveraged for further malicious activity.