{"resultsPerPage":9,"startIndex":0,"totalResults":9,"format":"NVD_CVEHistory","version":"2.0","timestamp":"2026-11-05T02:22:00.617","cveChanges":[{"change":{"cveId":"CVE-2026-25089","eventName":"New CVE Received","cveChangeId":"4D0727B5-15D8-4274-A30E-79CEB248C868","sourceIdentifier":"psirt@fortinet.com","created":"2026-06-09T16:16:39.943","details":[{"action":"Added","type":"Description","newValue":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests"},{"action":"Added","type":"CVSS V3.1","newValue":"AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H"},{"action":"Added","type":"CWE","newValue":"CWE-78"},{"action":"Added","type":"Reference","newValue":"https:\/\/fortiguard.fortinet.com\/psirt\/FG-IR-26-141"}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"Initial Analysis","cveChangeId":"FE0F2F21-86EC-4A47-A11B-BAC0AF387544","sourceIdentifier":"nvd@nist.gov","created":"2026-06-11T21:39:00.893","details":[{"action":"Added","type":"CPE Configuration","newValue":"OR\n          *cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* versions from (including) 4.2.0 up to (including) 4.2.8\n          *cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* versions from (including) 4.4.0 up to (excluding) 4.4.9\n          *cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* versions from (including) 5.0.0 up to (excluding) 5.0.6\n          *cpe:2.3:a:fortinet:fortisandbox_cloud:*:*:*:*:*:*:*:* versions from (including) 5.0.4 up to (excluding) 5.0.6\n          *cpe:2.3:a:fortinet:fortisandbox_paas:*:*:*:*:*:*:*:* versions from (including) 5.0.4 up to (excluding) 5.0.6"},{"action":"Added","type":"Reference Type","newValue":"Fortinet, Inc.: https:\/\/fortiguard.fortinet.com\/psirt\/FG-IR-26-141 Types: Vendor Advisory"}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"CVE Modified","cveChangeId":"2D0874FF-82E2-47B0-9E2D-7FB4F92FCA6D","sourceIdentifier":"psirt@fortinet.com","created":"2026-06-17T10:24:06.250","details":[{"action":"Added","type":"Affected","newValue":"New affected value received.  <a href=\"https:\/\/github.com\/CVEProject\/cvelistV5\/blob\/main\/cves\/2026\/25xxx\/CVE-2026-25089.json\">CVE-2026-25089<\/a>"}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"CVE Modified","cveChangeId":"40CBDDFE-C3E4-426D-893E-91FD7CD6962A","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-06-17T10:24:06.250","details":[{"action":"Added","type":"SSVC","newValue":{"timestamp":"2026-06-10T03:58:38.447554Z","id":"CVE-2026-25089","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"CVE Modified","cveChangeId":"3D5A0871-7D78-4AE1-817A-2DB63BB35473","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-07-16T18:16:42.823","details":[{"action":"Added","type":"Reference","newValue":"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089"},{"action":"Changed","type":"SSVC","oldValue":{"timestamp":"2026-06-10T03:58:38.447554Z","id":"CVE-2026-25089","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"},"newValue":{"timestamp":"2026-07-16T17:45:08.107935Z","id":"CVE-2026-25089","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"CVE CISA KEV Update","cveChangeId":"70F01794-6A66-4556-B7AB-E5E1551999EE","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","created":"2026-07-16T19:00:00.560","details":[{"action":"Added","type":"Date Added","newValue":"2026-07-16"},{"action":"Added","type":"Due Date","newValue":"2026-07-16"},{"action":"Added","type":"Required Action","newValue":"2026-07-16"},{"action":"Added","type":"Vulnerability Name","newValue":"2026-07-16"}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"Modified Analysis","cveChangeId":"0A84F6C8-97C5-464A-A35D-63F2DC364575","sourceIdentifier":"nvd@nist.gov","created":"2026-07-16T19:05:35.753","details":[{"action":"Added","type":"Reference Type","newValue":"CISA-ADP: https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089 Types: US Government Resource"}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"CVE Modified","cveChangeId":"9E03B14B-345D-4393-BA0A-D8D999B2CD55","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-07-17T05:16:38.687","details":[{"action":"Changed","type":"SSVC","oldValue":{"timestamp":"2026-07-16T17:45:08.107935Z","id":"CVE-2026-25089","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"},"newValue":{"timestamp":"2026-06-09T00:00:00+00:00","id":"CVE-2026-25089","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-25089","eventName":"CVE Translated","cveChangeId":"E3E5A940-37B7-46D1-A278-CE91E880C336","sourceIdentifier":"nvd@nist.gov","created":"2026-07-23T08:10:00.137","details":[{"action":"Added","type":"Translation","newValue":"Title: productos FortiSandbox de Fortinet, Description: Una neutralización inadecuada de elementos especiales utilizados en un comando de sistema operativo ('inyección de comandos de sistema operativo') vulnerabilidad en Fortinet FortiSandbox 5.0.0 hasta 5.0.5, FortiSandbox 4.4.0 hasta 4.4.8, FortiSandbox 4.2 todas las versiones, FortiSandbox Cloud 5.0.4 hasta 5.0.5, FortiSandbox PaaS 5.0.4 hasta 5.0.5 puede permitir a un atacante no autenticado ejecutar comandos no autorizados a través de solicitudes HTTP específicamente diseñadas."}]}}]}