CVE-2026-25089

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jul 23, 2026

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
Added to CISA KEV: Jul 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-25096.4The Page Builder: Pagelayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget's Custom Attributes fiel CVE-2026-250998.8Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, w CVE-2026-251005.4Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload p CVE-2026-251019.8Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. T CVE-2026-251047.8A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted CVE-2026-251058.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remo CVE-2026-251076.9ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who kn CVE-2026-251088.8FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a speciall CVE-2026-251098.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote CVE-2026-25117.5The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter CVE-2026-251103.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-251118.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote co