CVE-2026-25089

This vulnerability is like a “door” in FortiSandbox where a malicious request can trick the system into running attacker-chosen commands. Because attackers are already using it in the wild, an exposed device could be taken over and used to steal data or disrupt operations.

This matters if you run Fortinet FortiSandbox (including FortiSandbox Cloud or FortiSandbox PaaS) and your version falls within the vulnerable ranges covered by CVE-2026-25089 (5.0.0–5.0.5 or 4.4.0–4.4.8, plus affected 5.0.4–5.0.5 Cloud/PaaS). It’s a risk when the FortiSandbox service is reachable by attackers, especially via internet-accessible HTTP requests; CISA’s guidance also expects you to assess each asset’s internet exposure. Reachability is the gate—if it isn’t reachable from the attacker’s side, the risk is reduced, but known exploitation means you should not assume it’s safe.

This is RED because CISA confirmed active exploitation and added CVE-2026-25089 to its KEV catalog on 2026-07-16, with a required remediation due date of 2026-07-19. That means attackers are already working against vulnerable FortiSandbox systems, so you should prioritize upgrading and applying the vendor mitigations immediately.