Actively Exploited Fortinet FortiSandbox OS Command Injection Vulnerabilities (CVE-2026-39808 & CVE-2026-25089)

Overview

A critical OS command injection vulnerability, CVE-2026-39808 and CVE-2026-25089, affects Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS deployments. These OS Command Injection (CWE-78) flaws allow unauthenticated attackers to execute unauthorized operating system commands through specially crafted HTTP requests.
CISA has added both vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation in real-world attacks

Threat Details 

Affected Versions

1.CVE-2026-39808

Affected Versions

• FortiSandbox 4.4.0 through 4.4.8

Fixed Version

• FortiSandbox 4.4.9 or later

2. CVE-2026-25089

Affected Versions

• FortiSandbox 4.2.x

• FortiSandbox 4.4.x

• FortiSandbox 5.0.x

• FortiSandbox Cloud

• FortiSandbox PaaS

Fixed Versions

• Latest vendor-supported patched releases published by Fortinet.
   

Technical Details

Both vulnerabilities are caused by improper validation of user-controlled input, resulting in an OS Command Injection (CWE-78) vulnerability.

An unauthenticated attacker can send specially crafted HTTP requests to vulnerable FortiSandbox systems, causing the appliance to execute arbitrary operating system commands.

Successful exploitation may allow attackers to:

• Execute arbitrary OS commands.

• Gain Remote Code Execution (RCE).

• Deploy web shells.

• Install malware.

• Disable security services.

• Steal credentials.

• Move laterally within enterprise environments.

Attack Flow

1. Attacker identifies an internet-facing vulnerable FortiSandbox instance.

2. Crafted HTTP requests are sent to the vulnerable endpoint.

3. Unsanitized input is processed by the application.

4. Operating system commands are executed.

5. The attacker gains remote code execution.

6. Malware or web shells are deployed.

7. Lateral movement into internal systems is performed.

Impact

Successful exploitation may allow attackers to:

• Execute arbitrary operating system commands.

• Achieve remote code execution.

• Gain unauthorized administrative access.

• Deploy ransomware or malware.

• Steal credentials.

• Disable security monitoring.

• Pivot into internal enterprise networks.

• Completely compromise affected FortiSandbox appliances.

Recommendations

• Upgrade all FortiSandbox deployments to the latest patched versions immediately.

• Apply all Fortinet security updates.

• Restrict access to management interfaces.

• Review HTTP logs for suspicious requests.

• Investigate unexpected command execution activity

References

• CISA urges immediate action on actively exploited Fortinet flaws

• CISA Warns of Fortinet FortiSandbox OS Injection Vulnerabilities Exploited in Attacks

• https://www.cve.org/CVERecord?id=CVE-2026-39808

• https://www.cve.org/CVERecord?id=CVE-2026-25089