Fortinet FortiSandbox flaws CVE-2026-25089 and CVE-2026-39808 exploited; Cloud release status unclear
Two FortiSandbox flaws let attackers run commands without signing in. CISA confirms exploitation. Business IT teams should install the applicable fixes, migrate from 4.2 and confirm Cloud remediation with Fortinet.
For a business or family office using FortiSandbox, ask IT to upgrade appliances to 4.4.9 or 5.0.6 or later, migrate from 4.2, and update affected PaaS deployments to 5.0.6 or later. Ask Fortinet to confirm remediation for your Cloud service. Families who do not operate these business systems have nothing to update on their personal devices.
What’s happening
Two command-injection flaws affect Fortinet FortiSandbox, a business system for checking suspicious files. Both allow remote attackers to run commands without signing in. Fortinet published fixes in April and June, before researchers reported attack attempts in June and CISA confirmed exploitation on 16 July. CVE-2026-25089 affects appliance, Cloud and PaaS deployments; CVE-2026-39808 affects the appliance’s 4.4 branch and nine older PaaS builds identified in Fortinet’s CVE record. Released fixes include FortiSandbox 4.4.9 and 5.0.6, with separate PaaS upgrade requirements. FortiSandbox 4.2 users must migrate. Cloud status needs care: Fortinet says it remediated the issue and customers need take no action, but its published record still labels Cloud 5.0.6 as not released. A later Cloud release was not confirmed through 3 November, so overall patch status remains partial. July reporting also documented Fortinet’s exploitation flags disagreeing with CISA.
- What
- Flaw
- Affects
- Fortinet FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS
- Affected
- CVE-2026-25089: FortiSandbox 5.0.0–5.0.5 and 4.4.0–4.4.8
CVE-2026-25089: FortiSandbox 4.2, all versions
CVE-2026-25089: FortiSandbox Cloud 5.0.4–5.0.5
CVE-2026-25089: FortiSandbox PaaS 5.0.4–5.0.5
CVE-2026-39808: FortiSandbox 4.4.0–4.4.8
CVE-2026-39808: FortiSandbox PaaS 21.3.4055, 21.4.4072, 22.1.4113, 22.2.4134, 22.2.4151, 23.1.4245, 23.3.4329, 23.4.4350 and 23.4.4374 - Fixed in
- FortiSandbox 4.4.9 or later: both CVEs
FortiSandbox 5.0.6 or later: CVE-2026-25089
FortiSandbox PaaS 5.0.2 or later: CVE-2026-39808
FortiSandbox PaaS 5.0.6 or later: CVE-2026-25089
FortiSandbox Cloud 5.0.6: Fortinet says remediated with no customer action, but labels the version not released
FortiSandbox 4.2: migrate to a fixed release - Since
- 16 July 2026
- Closed
- 17 July 2026
Timeline
- Update
EmergentSec corrected its guidance to include FortiSandbox 4.2 and nine older PaaS builds named in Fortinet’s structured records. It also documented that Fortinet’s advisory exploitation flags still disagreed with CISA.
- CISA added
CISA added both CVEs to its Known Exploited Vulnerabilities catalogue. US federal agencies were given until 19 July to remediate.
- Wider attacks
Defused reported attempts against both flaws. SecurityWeek subsequently reported that the initially observed attempt against CVE-2026-25089 did not work.
- New fixPartly fixed
Fortinet disclosed CVE-2026-25089, with fixes in FortiSandbox 4.4.9 and 5.0.6 and PaaS 5.0.6. It told 4.2 users to migrate; it described Cloud as remediated but labelled Cloud 5.0.6 as not released.
- New fixPartly fixed
Fortinet published CVE-2026-39808. Its CVE record directs FortiSandbox users to 4.4.9 or later and affected older PaaS users to 5.0.2 or later.
Sources
- FG-IR-26-141: Second-Order OS Command Injection via JSON Input on start vnc featureFortinet · 9 June 2026
- Fortinet CNA record for CVE-2026-39808Fortinet, via the CVE Program · 14 Apr 2026
- Fortinet CNA record for CVE-2026-25089Fortinet, via the CVE Program · 9 June 2026
- 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker CrosshairsSecurityWeek · 17 June 2026
- CISA urges immediate action on actively exploited Fortinet flawsBleepingComputer · 17 July 2026
- Threat Bulletin: CVE-2026-25089 and CVE-2026-39808 in Fortinet FortiSandboxEmergentSec · 17 July 2026