CyberSecurityBoardThreat Intel · CVEs · Products
Critical CVEs

CVE-2026-25089: FortiSandbox Command Injection Vulnerability

June 25, 2026

A critical command injection vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI allows unauthenticated attackers to execute arbitrary OS commands via crafted HTTP requests. CVSS score 9.1.