Critical FortiSandbox Flaw Requires Immediate Patching

### Executive Summary A critical unauthenticated command-injection vulnerability (CVE-2026-25089, CVSS 9.1) in Fortinet FortiSandbox's web UI allows attackers to execute OS commands via specially crafted HTTP/JSON requests (start VNC feature), impacting FortiSandbox appliances, Cloud, and PaaS; Fortinet has published patches (e.g., upgrade to 5.0.6 or 4.4.9) and administrators should urgently verify versions, apply updates, and monitor for suspicious HTTP traffic.