CVE-2026-25089: Fortinet FortiSandbox Unauthenticated OS Command Injection — Find Exposed Instances — RECON Blog

CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV

Fortinet FortiSandbox contains a critical OS command injection vulnerability (CVSS 9.8) in the web UI allowing unauthenticated remote code execution via crafted HTTP requests. Third FortiSandbox CVE exploited in 2026. CISA KEV listed. Find exposed instances with RECON.

31 points by slvnx 97 days ago hellorecon.com 0 comments

Summary not yet generated for this article.

Comments (0 of ) ⌛

Loading more comments... ⌛

Scroll down to load more comments

No comments available.