PT-2026-24248 · Fortinet · Fortisandbox Cloud

Published 2026-03-10 · Updated 2026-05-12 · CVE-2026-25836

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox Cloud version 5.0.4

Description The system contains a flaw due to improper neutralization of special elements used in an operating system command, specifically an 'os command injection' issue. Successful exploitation may allow a remote attacker with super-admin privileges and CLI access to execute unauthorized code or commands through specially crafted HTTP requests. The vulnerability is triggered by crafted HTTP requests sent to the system. The vulnerable component involves the handling of special elements within operating system commands.

Recommendations Fortinet FortiSandbox Cloud version 5.0.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-03216

CVE-2026-25836

Affected Products

Fortisandbox Cloud

References · 5

• https://fortiguard.fortinet.com/psirt/FG-IR-26-096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03216 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25836 · Security Note
• https://t.me/cveNotify/163262 · Telegram Post
• https://twitter.com/CVEnew/status/2034136482202448142 · Twitter Post