CVE-2026-25836

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests.

Score

CVSS 3.1 7.2 High

Status

Modified - psirt@fortinet.com

Published

2026-03-10

Last modified

2026-05-12

Weaknesses

CWE-78

Affected products

• Fortisandbox Cloud (Fortinet)
• Fortisandboxcloud (Fortinet)
• Fortisandboxpaas (Fortinet)

References

• https://fortiguard.fortinet.com/psirt/FG-IR-26-096