HNGlance

Top Best New Show

CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV

https://hellorecon.com/blog/cve-2026-25089

by slvnx • 6 days ago

33 1 6 days ago

HE

Related Stories

Loading related stories...

Comments

1

psd1• 6 days ago

The flaw is reported to affect the "start VNC" feature — an attacker can inject shell metacharacters via JSON payloads in HTTP requests to this endpoint. No authentication is required, no user interaction is needed, and attack complexity is low.

I reassure myself that close to 100% of fortigate costumes have the control plane locked down.

I have come to believe that not a single embedded web server is without critical vulns, after deploying maybe a million patches to HP boxen for the iLO mgmt interface

I that it's largely only software companies that have a red team mindset, and only a minority of them. Everyone else is patching when upstream patches and job done.

Source preview

hellorecon.com

HNGlance

© 2024-2026 HN Glance. Story content belongs to its original sources.

Privacy
Terms