CVE-2026-25089Active Exploitation(fortinet / fortisandbox)

CISA has added two critical Fortinet FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, warning that attackers are actively exploiting the flaws in real-world attacks. The vulnerabilities, identified as CVE-2026-39808 and CVE-2026-25089, allow unauthenticated attackers to execute unauthorized operating system commands through specially crafted HTTP requests. Both issues are classified as OS command injection vulnerabilities, which occur when an application fails to properly sanitize user-controlled input.

🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-25089 PT ID: PT-2026-47809 Vendor: Fortinet Product: FortiSandbox Description: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests Link: https://github.com/HORKimhab/CVE-2026-25089 #dbugs_vuln

🚨We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours, including: CVE-2026-39813 (no previous recorded exploitation) CVE-2026-39808 CVE-2026-25089 (vibecoded, likely faulty exploit) Per our research a working exploit for CVE-2026-25089 has not yet been publicly disclosed. Track FortiSandbox exploitation 👉 https://console.defusedcyber.com/signup

🛡️We added Fortinet FortiSandbox vulnerabilities CVE-2026-25089 & CVE-2026-39808 and Microsoft SharePoint vulnerability CVE-2026-58644 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/jfzm47JWjo

Daniel's Daily Threat Intel & CVE Briefing (from claude) Tue 15 Jul 2026 Top of the stack: Microsoft's July Patch Tuesday (14 Jul) is the day's priority — a record ~570 Microsoft CVEs with two actively-exploited zero-days, both privilege-escalation bugs in identity infrastructure (AD FS and SharePoint). Patch those two first. In parallel, CISA added a decades-old Cisco IOS CSRF flaw (CVE-2008-4128) to KEV on 13 Jul after confirmed exploitation — audit legacy IOS management planes. Three items are flagged actively-exploited today. 1. CISA KEV / Actively Exploited (lead) CVE-2008-4128 — Cisco IOS CSRF → arbitrary command execution. Added to KEV 13 Jul 2026; confirmed in-the-wild exploitation of an 18-year-old flaw in the IOS web management interface. So what: internet-exposed or poorly-segmented IOS device web UIs are being abused for command execution — disable the HTTP(S) server or lock it behind ACLs. (SecurityAffairs, SC Media) CVE-2026-56155 — Microsoft AD FS EoP (CVSS 7.8), actively exploited. Local privilege escalation via insufficient access-control granularity in AD FS (see MS section). (ZDI) CVE-2026-56164 — Microsoft SharePoint EoP (CVSS 5.3), actively exploited. Missing authentication for a critical function, network-reachable, no user interaction. (BleepingComputer) Same-week KEV wave (7–10 Jul), all exploited — worth confirming remediation if in scope: Adobe ColdFusion path traversal → RCE (CVE-2026-48282); Langflow auth-bypass/IDOR (CVE-2026-55255) — noted as the first AI-agent platform added to KEV; and Joomla-ecosystem file-upload/access-control bugs (JoomShaper SP Page Builder CVE-2026-48908, Joomlack CVE-2026-56290, Balbooa CVE-2026-56291, iCagenda CVE-2026-48939). (The Hacker News, SecurityWeek) 2. Edge / Network Gear Quiet in the strict 24–48h window aside from the Cisco IOS KEV item above (CVE-2008-4128) — treat that as the actionable edge item today. No newly-corroborated critical Fortinet/Palo Alto/Citrix/Ivanti/SonicWall advisories published in the last day; the recent SecurityWeek Fortinet/Ivanti critical set (FortiSandbox CVE-2026-25089 CVSS 9.8, Ivanti Sentry CVE-2026-10520 CVSS 10.0) dates to mid-June and should already be in your patch cycle. 3. Microsoft / Windows / Active Directory Patch Tuesday, 14 Jul 2026 — largest on record. ~570 Microsoft-issued CVEs (≈621 counting all republished/third-party CVEs addressed); 59–63 rated Critical, ~48 of them RCE. (Tenable, ZDI) CVE-2026-56155 — AD FS EoP (7.8), exploited. Local EoP; high value in federated-identity environments. Patch AD FS servers first. CVE-2026-56164 — SharePoint EoP (5.3), exploited. Unauthenticated, network-based privilege escalation via missing auth — SharePoint remains under sustained attack (distinct from the CVE-2026-45659 RCE added to KEV on 1 Jul). Patch on-prem SharePoint immediately. CVE-2026-50661 — BitLocker security-feature bypass, publicly disclosed (not yet exploited). Requires physical access to reach encrypted data — relevant to lost/stolen-device and evil-maid threat models. So what: two of the three zero-days are identity/domain-compromise primitives — sequence AD FS and SharePoint ahead of the broader 570-CVE backlog. 4. Web / Cloud / DevOps Adobe ColdFusion CVE-2026-48282 (path traversal → RCE) and Langflow CVE-2026-55255 (auth-bypass IDOR — authenticated users can execute other users' flows) are both actively exploited and in KEV as of this week. If you run ColdFusion or Langflow (LLM/agent app builder), patch now. (http://Threat-Modeling.com) Adobe's July batch also included a ColdFusion CVSS 9.9 issue (not yet exploited) — standard-priority patch. (ZDI) No fresh corroborated Kubernetes/critical supply-chain 0-day in the 24h window; ongoing npm/PyPI credential-stealer campaigns continue as background noise. Watch / developing Langflow's KEV entry signals attackers are now hunting AI-agent/LLM orchestration platforms as an access vector — inventory any internet-exposed Langflow/agent tooling. Also watch the sheer triage load from the 570-CVE Patch Tuesday: with 48 critical RCEs, expect rapid PoC development over the coming days beyond the three flagged zero-days. Sign-off: 3 items flagged as actively exploited today (CVE-2026-56155, CVE-2026-56164, CVE-2008-4128), with a cluster of 4–6 additional exploited KEV entries from earlier this week still worth confirming as patched. Sources: CISA — CVE-2008-4128 Cisco IOS added to KEV (SecurityAffairs) ZDI — July 2026 Security Update Review BleepingComputer — July 2026 Patch Tuesday, 3 zero-days Tenable — July 2026 Patch Tuesday analysis The Hacker News — Adobe/Joomla/Langflow KEV additions SecurityWeek — CISA urges patching ColdFusion, Langflow, Joomla http://Threat-Modeling.com — CVE-2026-55255 Langflow IDOR SC Media — CISA adds Cisco IOS flaw to KEV

米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（7/16追加） CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability ✅概要 ・深刻度：緊急 9.8 (CVSS Base) / Fortinet, Inc. (CNA) ・種別：OSコマンドインジェクション (CWE-78) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Fortinet FortiSandbox、FortiSandbox Cloud、FortiSandbox PaaS に存在する OS コマンドインジェクションの脆弱性です。 FortiSandbox の start vnc 機能における JSON 入力処理に問題があり、未認証のリモート攻撃者が細工した HTTP リクエストを送信することで、不正なコマンドを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 ・BOD 26-04 対処期限（露出あり）：2026年7月19日 ・BOD 26-04 対処期限（露出なし）：2026年7月30日 ✅攻撃前提条件 ・Fortinet FortiSandbox、FortiSandbox Cloud、または FortiSandbox PaaS を使用している ・影響を受けるバージョンを使用している ・攻撃者が対象の FortiSandbox WEB UI へネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・修正済みバージョンへ更新されていない ✅悪用時影響 ・FortiSandbox 上で任意の OS コマンドを実行される可能性がある ・FortiSandbox の管理機能または分析基盤を不正操作される可能性がある ・セキュリティ分析基盤を侵害され、検知回避や追加侵害の足掛かりに利用される可能性がある ・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報 ・PoC/Exploit：一部公開（技術情報のみ） ・ITW：確認済み（Defused） ・概要：Defused Cyber が共有した脅威インテリジェンスでは、CVE-2026-25089 を含む FortiSandbox 脆弱性群に対する悪用開始を報告。 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-25089 ・https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ・https://github.com/cisagov/vulnrichment/blob/develop/2026/25xxx/CVE-2026-25089.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089 ・https://www.yazoul.net/advisory/cve/cve-2026-25089-fortisandbox-unauth-rce-poc/ ・https://iototsecnews.jp/2026/06/16/hackers-exploit-critical-fortinet-fortisandbox-flaws-in-active-attacks/ ・https://jvndb.jvn.jp/ja/cwe/CWE-78.html CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability ✅概要 ・深刻度：緊急 9.8 (CVSS Base) / Fortinet, Inc. (CNA) ・種別：OSコマンドインジェクション (CWE-78) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Fortinet FortiSandbox に存在する OS コマンドインジェクションの脆弱性です。 FortiSandbox の API エンドポイントにおける入力処理に問題があり、未認証のリモート攻撃者が細工した HTTP リクエストを送信することで、不正なコードまたはコマンドを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 ・BOD 26-04 対処期限（露出あり）：2026年7月19日 ・BOD 26-04 対処期限（露出なし）：2026年7月30日 ✅攻撃前提条件 ・Fortinet FortiSandbox 4.4.0 から 4.4.8 までの影響を受けるバージョンを使用している ・攻撃者が対象の FortiSandbox API エンドポイントへネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・FortiSandbox 4.4.9 以降へ更新されていない ✅悪用時影響 ・FortiSandbox 上で不正なコードまたは OS コマンドを実行される可能性がある ・root 権限でコマンドを実行される可能性がある ・FortiSandbox の分析結果や管理機能を不正操作される可能性がある ・セキュリティ分析基盤を起点に追加侵害へつなげられる可能性がある ・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開済み ・ITW：確認済み（Defused） ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-39808 ・https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ・https://github.com/cisagov/vulnrichment/blob/develop/2026/39xxx/CVE-2026-39808.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808 ・https://github.com/samu-delucas/CVE-2026-39808 CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ✅概要 ・深刻度：緊急 9.8 (CVSS Base) / Microsoft Corporation (CNA) ・種別：信頼できないデータのデシリアライゼーション (CWE-502) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Microsoft Office SharePoint に存在する、信頼できないデータのデシリアライゼーションに起因するリモートコード実行の脆弱性です。 未認証の攻撃者がネットワーク経由で悪用することで、SharePoint 上でコードを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 ・BOD 26-04 対処期限（露出あり）：2026年7月19日 ・BOD 26-04 対処期限（露出なし）：2026年7月30日 ✅攻撃前提条件 ・Microsoft SharePoint Enterprise Server 2016、Microsoft SharePoint Server 2019、または Microsoft SharePoint Server Subscription Edition を使用している ・SharePoint Enterprise Server 2016 で 16.0.5556.1005 未満を使用している ・SharePoint Server 2019 で 16.0.10417.20153 未満を使用している ・SharePoint Server Subscription Edition で 16.0.19725.20384 未満を使用している ・攻撃者が対象 SharePoint Server へネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・修正済み更新プログラムが適用されていない ✅悪用時影響 ・SharePoint Server 上でリモートコード実行につながる可能性がある ・SharePoint Server 上の機密情報へ不正アクセスされる可能性がある ・SharePoint Server 上のデータを改ざんされる可能性がある ・SharePoint Server の可用性に影響が生じる可能性がある ・オンプレミス SharePoint 環境を起点に追加侵害へつなげられる可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報確認できず ・ITW：未確認 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-58644 ・https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 ・https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-58644.json ・https://github.com/cisagov/vulnrichment/blob/develop/2026/58xxx/CVE-2026-58644.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644 https://www.cisa.gov/news-events/alerts/2026/07/16/cisa-adds-three-known-exploited-vulnerabilities-catalog #vulnerability

Daniel's Daily Threat Intel & CVE Briefing — Fri 7 Aug 2026 Top of the stack: Today is CISA's federal remediation due date for the N-able N-central / Langflow / Tomcat KEV batch — and the N-central bug is the one that matters: CVE-2026-18577, an auth-bypass that is a bypass of the incomplete fix for CVE-2026-18556, is being exploited in the wild since Aug 1 to seize admin on RMM servers and pivot into managed endpoints. If you or clients run N-central, patch to 2026.3.1 Hotfix 1 (2026.3.1.7) and hunt for post-compromise activity before anything else today. 1. CISA KEV / actively exploited (lead) CVE-2026-18577 — N-able N-central, all versions ≤ 2026.3.1 (pre-Hotfix 1). Unauth auth-bypass → full admin. Exploited in the wild from Aug 1; added to KEV Aug 3. Post-exploit TTPs: abuse of the Take Control feature to reach managed endpoints + Cloudflare Tunnel for persistent backdoor. Fix: 2026.3.1.7. So what: RMM = one box to own the whole estate; treat any unpatched N-central as presumed-compromised. CVE-2026-18556 — N-able N-central auth-bypass (the incompletely-patched precursor to 18577), CVSS 8.2. KEV, federal due date today. CVE-2026-9198 — Langflow (open-source AI app-dev platform), CVSS 9.8, unauth code-injection → RCE. Fixed 1.10.1. Repeatedly weaponized in recent months; KEV, due today. So what: internet-exposed AI/LLM tooling is now a routine initial-access target. CVE-2026-34486 — Apache Tomcat, CVSS 7.5, EncryptInterceptor cluster-messaging bypass. Fixed 11.0.21 / 10.1.54 / 9.0.117. Tied to SNOWLIGHT malware campaign; KEV, due today. CVE-2026-63077 — JetBrains TeamCity deserialization flaw, added to KEV this week. Verify your CI/CD estate isn't exposing TeamCity to untrusted networks. 2. Edge / network gear CVE-2026-20316 — Cisco Secure Firewall Management Center (FMC) 7.0–7.7 / 10.0. Static credentials for a low-priv account → unauth remote access to sensitive data; actively exploited as a zero-day (disclosed Jul 30). Base CVSS only 5.3 but Cisco rates SIR High because it's chainable for privilege escalation. So what: not the headline score, but it's live and it's your firewall manager — patch and rotate. Fortinet/Ivanti criticals (FortiSandbox CVE-2026-25089 9.8; Ivanti Sentry CVE-2026-10520 10.0 / CVE-2026-10523 9.9) are from the June 10 cycle — no new exploitation reported in the last 24–48h; flagged only in case anything remains unpatched. 3. Microsoft / Windows / AD Quiet in the last 24h. No new in-the-wild Windows/AD/Exchange/Entra items surfaced. August Patch Tuesday lands Aug 11 — July's record 622-flaw cycle (2 zero-days under active attack) should already be deployed; if not, that's your gap. 4. Web / cloud / DevOps CVE-2026-66066 — Rails Active Storage (< 7.2.3.2, 8.0.x < 8.0.5.1, 8.1.x < 8.1.3.1; 6.x only if configured off-default). Critical; unauth arbitrary file read → potential RCE via libvips ("KindaRails2Shell", pivots on the app master key). Public PoC available (disclosed Aug 1). Mitigation: upgrade Rails/Active Storage, libvips ≥ 8.13, ruby-vips ≥ 2.2.1. CVE-2026-63030 + CVE-2026-60137 — WordPress core "wp2shell" chain (REST batch-route confusion + author__not_in SQLi). Unauth RCE on default installs 6.9.0–6.9.4 / 7.0.0–7.0.1. Public exploits on GitHub; watchTowr reports in-the-wild exploitation. Fixed 6.9.5 / 7.0.2 (forced auto-update pushed). Slightly older (Jul 18) but still actively exploited — worth a scan sweep. Watch / developing Oracle out-of-band Security Alert CVE-2026-35273 surfaced this week — details thin, worth confirming scope. Senserva notes ~30 KEV entries this month with 2 tied to ransomware campaigns (Microsoft/Fortinet/Cisco most-affected) — watch for ransomware operators folding the N-central and Langflow bugs into their access-broker playbooks. Sign-off: 7 items flagged actively exploited today (N-central ×2, Langflow, Tomcat, TeamCity, Cisco FMC, WordPress wp2shell); the single must-do is patching N-central before CISA's due date closes. Sources: CISA — Adds Three KEVs (Aug 4) CISA — Adds One KEV (Aug 3) The Hacker News — CISA flags Langflow, Tomcat, N-central Rapid7 — CVE-2026-18577 N-central exploited in the wild N-able — N-central Security Update (Aug 2) The Hacker News — Cisco FMC zero-day actively exploited BleepingComputer — Rails Active Storage RCE (CVE-2026-66066) BleepingComputer — WordPress wp2shell RCE public exploits SecurityWeek — Fortinet/Ivanti critical patches Senserva — CISA KEV additions this week One caveat worth noting for your own verification: NVD detail pages were unreachable during this run, so severities above are corroborated against vendor advisories, CISA, and reputable trackers rather than NVD directly — the Langflow 9.8 and Cisco 5.3 figures each have two independent sources, but confirm against NVD before citing formally.

FortiSandbox has two unauthenticated command-injection RCEs — CVE-2026-25089 &amp; CVE-2026-39808, CVSS 9.8. Both on CISA KEV, exploited in the wild, federal patch deadline Jul 19. The catch: it's the box your Fortinet fabric asks whether a file is malware. Runbook 🧵 https://t.co/a1Ixtihx8G

🚨 Upozorňujeme na aktivně zneužívané zranitelnosti ve Fortinet FortiSandbox, CVE-2026-39813, CVE-2026-39808, CVE-2026-25089. Útočníci aktivně zneužívají více chyb ve FortiSandbox, přičemž CVE-2026-39813 (CVSS 9.1) představuje path traversal v JRPC API umožňující neautentizovanému útočníkovi obejít autentizaci prostřednictvím speciálně upravených HTTP požadavků. CVE-2026-39808 (CVSS 9.1) je zranitelnost typu OS command injection, která umožňuje neautentizovanému útočníkovi spouštět neautorizovaný kód či příkazy přes podvržené HTTP požadavky. CVE-2026-25089 (CVSS 9.1) je rovněž OS command injection ovlivňující FortiSandbox, FortiSandbox Cloud a FortiSandbox PaaS WEB UI, která umožňuje spuštění neautorizovaných příkazů bez nutnosti autentizace pomocí speciálně vytvořených HTTP požadavků. Dostupné exploity vykazují znaky generování pomocí AI, nicméně nejsou zatím plně funkční. Všechny zranitelnosti mohou vést k úplnému kompromitování zařízení při vystavení služby síti a nevyžadují předchozí přihlášení, přičemž jejich zneužití bylo pozorováno v reálných útocích během posledních 24 hodin. 📌Doporučujeme FortiSandbox aktualizovat na nejnovější verzi.

رصد استغلال ثغرتين أمنيتين حرجتين في FortiSandbox في هجمات فعلية، يدفع @CISAgov لإصدار توجيه ملزم بمعالجتهما قبل حلول 19 يوليو الجاري تسمح الثغرتان (CVE-2026-39808) و(CVE-2026-25089) بتنفيذ التعليمات البرمجية عن بعد دون تفاعل المستخدم عبر آليات حقن الأوامر. https://t.co/1m0Y3uczip

@DefusedCyber Fortisandbox is vulnerable to an exploit: CVE-2026-25089 And as FortiOS, it's prone to any matching version FortiOS exploit. I am getting good at this Forti thing. Working on Fortinet Hunter but will stay uberpriv8. FortiOS is a pain in the ass to work with tbh.

🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik #GüvenlikBülteni Merhaba #Brolyz 🎯 Zafiyet Bilgisi Ürün: #Fortinet FortiSandbox / #FortiSandbox Cloud / FortiSandbox PaaS #Zafiyet: İşletim Sistemi Komut Enjeksiyonu (OS Command Injection) CVE: CVE-2026-25089 Zafiyet Türü: OS Command Injection (CWE-78) Fidye Yazılımı İlişkisi: Şu an için bilinmiyor. 📌 Zafiyet Özeti Fortinet FortiSandbox, FortiSandbox Cloud ve FortiSandbox PaaS ürünlerinde İşletim Sistemi Komut Enjeksiyonu (OS Command Injection) zafiyeti tespit edilmiştir. Bu güvenlik açığı, kimlik doğrulaması gerektirmeyen bir saldırganın özel olarak hazırlanmış HTTP istekleri aracılığıyla cihaz üzerinde yetkisiz işletim sistemi komutları çalıştırmasına olanak tanıyabilir. Başarılı bir istismar sonucunda saldırgan, FortiSandbox sistemi üzerinde uzaktan komut çalıştırabilir, güvenlik mekanizmalarını devre dışı bırakabilir, hassas verilere erişebilir ve kurumsal ağ içerisinde ilerleyerek daha kapsamlı saldırılar gerçekleştirebilir. 🛡️ Önerilen Aksiyonlar ✅ Güvenlik Güncellemeleri Fortinet tarafından yayımlanan güvenlik güncellemelerini ve önerilen hafifletici önlemleri (Mitigations) test ettikten sonra en kısa sürede canlı ortama uygulayın. ✅ Risk Yönetimi Süreçlerinizi CISA'nın BOD 26-04 (Risk Tabanlı Güvenlik Güncellemelerinin Önceliklendirilmesi) ve Forensics Triage Requirements rehberlerine uygun şekilde yönetin. ✅ Erişim Kontrolleri İnternete açık FortiSandbox sistemlerini öncelikli olarak değerlendirin. Yönetim arayüzlerine erişimi yalnızca güvenilir ağlarla sınırlandırın. Web yönetim arayüzü için IP kısıtlamaları, MFA ve erişim kayıtlarının sürekli izlenmesini sağlayın. ✅ Geçici Koruma Önlemleri Güvenlik güncellemesi veya önerilen hafifletici önlemler uygulanamıyorsa, FortiSandbox yönetim arayüzünün internet erişimini geçici olarak kapatın veya yalnızca VPN üzerinden erişilebilir hale getirin. 📚 Referans: Fortinet Security Advisories & CISA

Deux vulnérabilités critiques (CVE-2026-39808 et CVE-2026-25089) touchant FortiSandbox sont désormais exploitées dans des attaques. Leur inscription au catalogue KEV de la CISA confirme l’urgence de mettre à jour les systèmes concernés. https://tinyurl.com/yjvj5njk

CVE-2026-25089 is a critical OS command injection vulnerability discovered in Fortinet FortiSandbox versions 4.4.0–4.4.8, 5.0.0–5.0.5, and corresponding Cloud and Platform as a Service deployments. Learn more in our latest security bulletin: https://arcticwolf.com/resources/blog/cve-2026-25089/?utm_source=twitter&utm_medium=social&utm_campaign=ADV%20FY27%20Social%20Twitter

Critical OS Command Vulnerability has been discovered in #Fortinet's #FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS. Users are advised to follow OEM Security Advisories to remain safe! #CVE-2026-25089 https://www.fortiguard.com/psirt/FG-IR-26-141

ぱっちちゅーずでー ▼Microsoft 2026 年 6 月のセキュリティ更新プログラム (月例) https://www.microsoft.com/en-us/msrc/blog/2026/06/202606-security-update ▼SAP SAP Security Patch Day - June 2026 https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html ▼Ivanti Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523) https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-6973 & CVE-2026-10727) https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US ▼Fortinet PSIRT Advisories | FortiGuard Labs https://fortiguard.fortinet.com/psirt Second-Order OS Command Injection via JSON Input on start vnc feature（CVE-2026-25089） https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ▼Adobe https://helpx.adobe.com/security.html

⚠️ Vulnerabilidad en productos Fortinet ❗ CVE-2026-25089 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-fortinet-5/ https://t.co/j4gDmjqV4s

FortiSandboxに重大(Critical)な脆弱性。CVE-2026-25089はCVSSスコア9.1で、細工されたHTTPリクエストによる無認証でのコマンドインジェクション。VNC開始機能へのJSON入力が脆弱。修正版提供あり。 https://securityonline.info/cve-2026-25089-fortisandbox-patch/

La CISA ordena a las agencias gubernamentales de EE. UU. priorizar el parcheo de dos vulnerabilidades críticas en Fortinet FortiSandbox (CVE-2026-39808 y CVE-2026-25089) que permiten a atacantes no autenticados ejecutar código de forma remota… https://www.bleepingcomputer.com/news/security/cisa-warns-feds-to-patch-exploited-fortinet-fortisandbox-flaws-by-sunday/ https://t.co/lzGxd3OPXE

嫌な3件が一気に来た。CISAが実悪用を確認したFortiSandbox 2件とSharePoint 1件をKEVへ追加。CVE-2026-25089／CVE-2026-39808はCVSS 9.1、認証不要のHTTP requestからOS commandを実行される。前者はFortiSandbox 4.2全版、4.4.0〜4.4.8、5.0.0〜5.0.5など、後者は4.4.0〜4.4.8が対象。CVE-2026-58644はSharePoint Server 2016／2019／Subscription Editionの認証不要RCEでCVSS 9.8だ。 現場で怖いのは、脅威解析基盤と情報共有基盤が侵入口になること。CSIRTはinternet-facing資産とversion、FortiSandboxのWeb/API access logと不審process、SharePointのIIS/ULS logとw3wp.exe配下のprocess生成を棚卸ししてほしい。patch適用だけで閉じず、侵害調査までが初動。次の定例を待たない案件だ。#セキュリティ