QSearchQSearch

CVE-2026-25089

9.8 CRITICAL

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0...

Published: 2026-06-09 · Last updated: 2026-06-09

Severity and scoring

CVSS
9.8 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-78

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-24719 — A command injection vulnerability has been reported to affect several QNAP operating system versions
  • CVE-2026-22893 — A command injection vulnerability has been reported to affect several QNAP operating system versions
  • CVE-2025-66279 — A command injection vulnerability has been reported to affect several QNAP operating system versions
  • CVE-2025-66273 — A command injection vulnerability has been reported to affect several QNAP operating system versions
  • CVE-2026-49959 — Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitr... (8.8 HIGH)