PT-2026-24248 · Fortinet · Fortisandbox Cloud

Publicado 2026-03-10 · Atualizado 2026-05-12 · CVE-2026-25836

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox Cloud version 5.0.4

Description The system contains a flaw due to improper neutralization of special elements used in an operating system command, specifically an 'os command injection' issue. Successful exploitation may allow a remote attacker with super-admin privileges and CLI access to execute unauthorized code or commands through specially crafted HTTP requests. The vulnerability is triggered by crafted HTTP requests sent to the system. The vulnerable component involves the handling of special elements within operating system commands.

Recommendations Fortinet FortiSandbox Cloud version 5.0.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2026-03216

CVE-2026-25836

Produtos afetados

Fortisandbox Cloud

Referências · 5

• https://t.me/cveNotify/163262 · Publicação no Telegram
• https://fortiguard.fortinet.com/psirt/FG-IR-26-096 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-03216 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-25836 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034136482202448142 · Publicação no Twitter