CVE-2026-25089 and CVE-2026-39808: The FortiSandbox Chain That Reaches Unauthenticated Root

FortiSandbox is the appliance organizations buy specifically to detonate files they don’t trust yet. That makes it an unusually bad place to have a command injection bug, and as of July 16, 2026, it has two that CISA confirms are being actively exploited, chained with a third to skip authentication entirely.

The two CVEs CISA added

CISA’s July 16 Known Exploited Vulnerabilities update added CVE-2026-25089 and CVE-2026-39808, both OS command injection flaws in FortiSandbox, alongside an unrelated SharePoint bug in the same batch.

CVE-2026-25089 (CVSS 9.8) lives in the web UI’s “Start VNC” feature. Fortinet’s own product security team found it internally, credited to Adham El Karn. CVE-2026-39808 (CVSS 9.1) is a different bug in the FortiSandbox API, at the /fortisandbox/job-detail/tracer-behavior endpoint. The vulnerable parameter is jid, a GET parameter that the application hands to an OS-level process without stripping shell metacharacters:

GET /fortisandbox/job-detail/tracer-behavior?jid=1234|<command>

A pipe character followed by an arbitrary command in that parameter executes as root. No sanitization, no allowlist, just a raw pass-through into a shell call.

Used individually, both bugs assume the attacker already has a session on the management interface. That’s the part that changes with the third CVE in the chain.

Why “authenticated” doesn’t hold as a mitigation

CVE-2026-39813 is a path traversal vulnerability in FortiSandbox’s JRPC API. On its own it’s a file-read bug: point it at the right path and it hands back file contents an unauthenticated caller shouldn’t see. Point it at FortiSandbox’s configuration database, and it hands back stored admin credentials.

The chain security researchers documented runs like this:

1. CVE-2026-39813 reads the config database via path traversal, no login required.
2. Credentials extracted from that database get the attacker an authenticated session.
3. CVE-2026-25089 or CVE-2026-39808 takes it from there, injecting OS commands that execute as root.

Three bugs, individually rated as needing some form of access, that in sequence produce unauthenticated root code execution. This is the pattern that makes “but that one needs credentials” a weak argument during triage: if a lower-severity bug on the same box can hand an attacker those credentials, the chain’s actual severity is the severity of its worst step, not its first one. It’s the same logic behind treating idempotency and authorization as separate concerns rather than assuming one control covers a whole request path.

Who’s exposed

Branch	Status
4.2.x (all releases)	Vulnerable
4.4.0 – 4.4.8	Vulnerable
4.4.9 and later	Fixed
5.0.0 – 5.0.5	Vulnerable
5.0.6 and later	Fixed
FortiSandbox Cloud / PaaS, below 5.0.6	Vulnerable

If your instance is internet-facing, which some FortiSandbox management interfaces are despite Fortinet’s guidance to keep them isolated, treat this as urgent rather than routine. Security researchers reported scanning and exploitation attempts against the chain in the weeks before CISA’s KEV listing made it official, and public detail on the vulnerable endpoints is now widely available, which tends to widen the pool of attackers capable of using it.

What to check this week

Confirm your FortiSandbox build number against the fixed floors above, patch to 4.4.9 or 5.0.6 if you’re behind, and while you’re in there, pull the management interface off any network path it doesn’t strictly need. FortiSandbox’s entire job is to sit near untrusted content; giving it a smaller attack surface of its own is not optional hardening, it’s the appliance doing the one thing it was bought to do. If you can’t patch immediately, restrict access to the web UI and API to a management VLAN and review recent VNC session and JRPC access logs for requests you can’t account for.

Command injection chains that start with an unauthenticated file read are common enough that they’re worth checking for by pattern, not just by CVE number, the next time your security team reviews an appliance that touches anything untrusted by design.