CVE-2026-25089: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5

Synopsis

OS command injection vulnerability in Fortinet FortiSandbox allows an unauthenticated remote attacker to inject and execute arbitrary operating system commands by sending specially crafted HTTP requests to the affected service. The vulnerability is reachable over the network with no authentication or user interaction required, making it exploitable without any preconditions. Successful exploitation gives the attacker full control over the host, including the ability to read sensitive data, modify system state, and disrupt service availability. No fix versions have been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FortiSandbox HTTP service over the network; any internet-exposed or internally reachable deployment is in scope.

• AuthenticationNot required

  No credentials or account of any privilege level are needed; the injected commands are accepted from unauthenticated HTTP requests.

• Victim interactionNot required

  No user action is required; the attacker sends crafted HTTP requests directly to the service without involving any human victim.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or prior reconnaissance.

Blast Radius

• The attacker executes arbitrary OS commands as the process user on the FortiSandbox host, gaining full shell-level access to the underlying system.
• Confidential data stored or processed by FortiSandbox, including submitted file samples, analysis results, and stored credentials, is readable by the attacker.
• The attacker can modify or delete configuration files, analysis databases, and operating system binaries, corrupting the integrity of the sandbox environment.
• The attacker can terminate processes, exhaust resources, or wipe the system, taking the FortiSandbox service fully offline.