We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·19d ago·5 min read
CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV
TL;DR
Fortinet FortiSandbox has a critical unauthenticated OS command injection vulnerability (CVE-2026-25089) in its web interface. Attackers can exploit this flaw to execute arbitrary commands without authentication, affecting the 'start VNC' feature.
✦ Why It Matters
Security teams should immediately audit their FortiSandbox instances for this vulnerability and apply necessary patches.
Key Takeaways
- Patch FortiSandbox to version 4.4.9+ or 5.0.6+ immediately.
- Restrict access to the management interface to trusted networks only.
- Conduct audits of Fortinet product integrations for unexpected changes.
- Monitor logs for unusual access patterns or configuration modifications.
Full Summary
CVE-2026-25089 is a severe vulnerability in Fortinet's FortiSandbox, rated with a CVSS score of 9.8, indicating critical severity. It allows unauthenticated attackers to execute OS commands through the web interface by injecting shell metacharacters via JSON payloads.
This vulnerability is particularly concerning as it is the third such flaw exploited in the wild within a short timeframe, following two others patched earlier in 2026. FortiSandbox is integral to various Fortinet products, making it a high-value target for attackers.
To mitigate risks, organizations are advised to identify exposed instances, patch the software, and restrict access to the management interface. The vulnerability underscores the importance of maintaining robust security practices for network appliances.