Fortinet patched a new critical FortiSandbox flaw

Fortinet released security updates to fix a critical FortiSandbox OS command injection vulnerability (CVE-2026-25089, CVSS 9.8) that could allow unauthenticated attackers to execute arbitrary commands via crafted HTTP requests; affected FortiSandbox and FortiSandbox Cloud/PaaS versions are listed with upgrade guidance. The advisory also addresses two medium-severity flaws in FortiOS, FortiProxy, and FortiPortal, and the vendor reported no known active exploitation at the time of disclosure.