CVE-2026-25089

Medienbericht

EPSS 23.39%
Veröffentlicht 09.06.2026 14:27:47
Zuletzt bearbeitet 11.06.2026 21:39:00
Quelle psirt@fortinet.com
CVE-Watchlists
Login
Unerledigt
Login

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 9

NVD 5 VulnDex Vulnerability Enrichment 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Fortinet ≫ Fortisandbox Version >= 4.2.0 <= 4.2.8

Fortinet ≫ Fortisandbox Version >= 4.4.0 < 4.4.9

Fortinet ≫ Fortisandbox Version >= 5.0.0 < 5.0.6

Fortinet ≫ Fortisandbox Cloud Version >= 5.0.4 < 5.0.6

Fortinet ≫ Fortisandbox Paas Version >= 5.0.4 < 5.0.6

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	23.39%	0.975

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
psirt@fortinet.com	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.