Critical Command Injection (CVE‑2026‑25089) in FortiSandbox Affects Fortinet, Ivanti, and SAP – Patches Issued
What It Is – A high‑severity command‑injection flaw (CVE‑2026‑25089) was discovered in FortiSandbox’s web UI (on‑prem, cloud, and PaaS deployments). The vulnerability allows an unauthenticated attacker to inject arbitrary OS commands, leading to remote code execution and potential information disclosure. Parallel critical bugs were also found in Ivanti and SAP products, prompting coordinated patch releases.
Exploitability – The vulnerability scores 9.1 (CVSS v3.1), indicating a critical impact. Public proof‑of‑concept code has been shared on underground forums, and active exploitation attempts have been observed in the wild against unpatched FortiSandbox instances.
Affected Products –
- Fortinet: FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS (WEB UI)
- Ivanti: Patch Manager, Security Controls (specific CVEs not disclosed)
- SAP: Business Technology Platform components (specific CVEs not disclosed)
TPRM Impact – Third‑party risk managers must treat these flaws as supply‑chain threats. An exploited FortiSandbox could be leveraged to pivot into downstream customers’ networks, exfiltrate data, or embed ransomware. Unpatched Ivanti and SAP services increase the attack surface for organizations that rely on these vendors for endpoint management and enterprise resource planning.
Recommended Actions –
- Apply the latest security patches from Fortinet, Ivanti, and SAP immediately.
- Verify patch deployment via version checks and vendor‑provided verification scripts.
- Conduct a post‑patch vulnerability scan of all affected assets to confirm remediation.
- Review network segmentation around FortiSandbox components; restrict UI access to trusted IP ranges.
- Update incident response playbooks to include detection signatures for the known exploit patterns.
- Notify internal stakeholders and any downstream customers of the remediation status.
Source: The Hacker News – Ivanti, Fortinet and SAP Release Patches for Multiple Critical Vulnerabilities