Is CVE-2026-25089 being actively exploited?

Yes. CVE-2026-25089 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on July 16, 2026.

What is the CVSS score for CVE-2026-25089?

CVE-2026-25089 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2026-25089

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 76.1%EU EUVD: exploited

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
EPSS score: 76.1% (100th percentile)
In CISA KEV: Yes, added July 16, 2026
In EU EUVD: Yes (EUVD-2026-35443)
Published: June 9, 2026
NVD last modified: July 23, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet FortiSandbox OS Command Injection Vulnerability

Added to the KEV catalog on July 16, 2026; federal remediation due July 19, 2026.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-35443 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on July 17, 2026.

View on the EU Vulnerability Database

Affected products

fortinet / fortisandbox
fortinet / fortisandbox cloud
fortinet / fortisandbox paas

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

FortiSandbox 4.4 - Fortinet, Inc. - Common Criteria CCEVS-VR-VID-11636-2025 - active

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-141(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain