CVE-2026-39808

CVE: Fortinet FortiSandbox OS Command Injection Vulnerability: Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
CWE: CWE-78
Published: Fortinet | FortiSandbox
Link: https://www.cve.org/CVERecord?id=CVE-2026-39808

Threat Analysis (Fortinet FortiSandbox OS Command Injection Vulnerability: Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.)

  1. Impact – Unauthenticated remote code execution (RCE) on the FortiSandbox OS can lead to full system compromise, data exfiltration, privilege escalation, or use as a foothold for lateral movement.

  2. Affected components/attack surface – The OS command interpreter and HTTP request processing layer of FortiSandbox (the embedded OS). The vulnerability resides in a command‑parsing function exposed via HTTP.

  3. Exploitation prerequisites/conditions – No authentication required; a crafted HTTP request containing a malicious payload can be sent to the vulnerable endpoint. Minimal assumption: the endpoint is publicly reachable and processes the request as‑is.

  4. Detection ideas/indicators – Unexpected shell output, high‑entropy command strings in logs, repeated execution of the CVE‑2026‑39808 ID in security alerts, or anomalous process creation from HTTP handlers.

  5. Mitigations/workarounds – Deploy the latest OS patch, disable or restrict HTTP command‑execution features, validate/sanitize all incoming HTTP payloads server‑side, isolate FortiSandbox from the internet, and enforce network segmentation.

  6. Verification steps – Send a crafted HTTP request with the payload, confirm unauthorized command execution, verify the system is patched (CVE‑2026‑39808 removed from logs), and monitor for any further anomalous activity.

CVE-2026-25089

CVE: Fortinet FortiSandbox OS Command Injection Vulnerability: Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
CWE: CWE-78
Published: Fortinet | FortiSandbox
Link: https://www.cve.org/CVERecord?id=CVE-2026-25089

Threat Analysis (Fortinet FortiSandbox OS Command Injection Vulnerability: Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.)

  1. Impact – An unauthenticated attacker can inject arbitrary OS commands into FortiSandbox services, achieving full control of the sandboxed environment (e.g., privilege escalation, data exfiltration, or denial‑of‑service). This can compromise any data processed within the sandbox and potentially propagate to the host platform.

  2. Affected components/attack surface – The vulnerability resides in the web‑based interfaces of FortiSandbox (FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS). Any HTTP request sent to these services is processed by the underlying OS, making the entire web front‑end the vulnerable surface.

  3. Exploitation prerequisites – Minimal assumptions: (a) the attacker can reach the web interface; (b) the service does not enforce input validation or command sanitisation; (c) the command injection payload is URL‑encoded as a query or form parameter. No authentication is required; the request must be crafted to trigger command execution.

  4. Detection ideas/indicators – Logs showing unexpected command strings (e.g., sh, bash, curl -c, base64) in request payloads; sudden spikes in process creation events; HTTP 500 errors with suspicious payloads; repeated unauthenticated POSTs with long or encoded strings.

  5. Mitigations/workarounds – Implement strict input validation/sanitisation for all HTTP inputs; enforce WAF rules to block command‑related strings; restrict service to authenticated users only; disable the vulnerable service if not needed; use container isolation to limit OS command execution.

  6. Verification steps – Run a controlled test: send a crafted HTTP request (e.g., GET /sandbox?cmd=whoami) and confirm the service returns the attacker’s username or executes a command; verify that the same request is blocked by the WAF or returns an error; ensure no command execution occurs in logs.

CVE-2026-58644

CVE: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability: Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
CWE: CWE-502
Published: Microsoft | SharePoint
Link: https://www.cve.org/CVERecord?id=CVE-2026-58644

Threat Analysis (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability: Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.)

  1. Impact: Remote code execution (RCE) on the SharePoint server, enabling attacker to elevate privileges, exfiltrate data, or install malware.

  2. Affected components: SharePoint Server (on‑premises) and SharePoint Online (SPFUS) processing pipeline; specifically the deserialization routine in the SPFUS request handler.

  3. Prerequisites: Ability to send a crafted SPFUS HTTP POST to the target’s /_layouts/15/spfus.aspx endpoint; network access; no additional authentication bypass required.

  4. Detection ideas: Persistent high CPU or memory usage on SPFUS endpoint, creation of unexpected PowerShell or .NET processes, anomalous HTTP POSTs to SPFUS URL, or failed security‑event alerts for deserialization warnings.

  5. Mitigations/workarounds: Disable SPFUS service, remove the /spfus.aspx URL from web.config, apply the latest Microsoft patch, or migrate to SharePoint Online where SPFUS is not available.

  6. Verification steps: Confirm SPFUS endpoint is inaccessible, patch version matches the release, and no remote code execution occurs via manual test or passive monitoring.

CVE-2023-4346

CVE: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability: KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
CWE: CWE-645
Published: KNX Association | KNX Protocol Connection Authorization Option 1
Link: https://www.cve.org/CVERecord?id=CVE-2023-4346

Threat Analysis (KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability: KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.)

  1. Impact: The vulnerability enables an attacker to permanently lock the BCU’s key, rendering all KNX‑connected devices inaccessible and causing a remote denial‑of‑service.

  2. Affected components/attack surface: KNX Association KNX Protocol Connection Authorization Option 1 firmware on Building Control Units (BCUs) that implement the lockout mechanism; no other system components are directly impacted.

  3. Exploitation prerequisites/conditions (minimal assumptions): The attacker must be able to send the specific lockout command via the KNX network and must have access to the BCU’s communication interface; no additional security options need to be enabled.

  4. Detection ideas/indicators: Unexpected lockout events logged by the BCU, persistent device unresponsiveness, repeated attempts to unlock that fail, and a BCU key state that remains locked after reboot.

  5. Mitigations/workarounds: Patch the BCU firmware to remove the overly restrictive lockout; configure BCUs to allow temporary lockouts with additional security options; disable the option if unnecessary; monitor lockout counters.

  6. Verification steps: Send the lockout command to a test BCU, confirm the device locks and remains locked after a reboot, and verify that no authentication is required to trigger the lockout.

CVE-2026-46817

CVE: Oracle E-Business Suite Improper Privilege Management Vulnerability: Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
CWE: CWE-269|
Published: Oracle | E-Business Suite
Link: https://www.cve.org/CVERecord?id=CVE-2026-46817

Threat Analysis (Oracle E-Business Suite Improper Privilege Management Vulnerability: Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.)

  1. Impact: Unauthorized takeover of Oracle Payments, enabling attackers to manipulate or extort financial transactions and potentially access other Oracle E‑Business Suite modules.

  2. Affected components/attack surface: HTTP‑exposed Payments service in Oracle E‑Business Suite (EBS), the privilege‑management functions exposed via web requests, and the underlying database credentials.

  3. Exploitation prerequisites: Unauthenticated attacker with network access to the EBS HTTP endpoint (e.g., via the Payments web service). CWE‑269 (Insufficient Authentication/Authorization) is the root cause; no valid credentials or session token are required.

  4. Detection ideas/indicators: Unexpected HTTP 404/500 responses to /payments/* endpoints, missing “Authorization” header in logs, repeated privilege‑escalation probes, SIEM alerts for privilege‑bypass attempts, and alerts referencing CVE‑2026‑46817.

  5. Mitigations/workarounds: Enforce mandatory authentication/authorization for the Payments module, block unauthenticated HTTP access via firewall or WAF, patch EBS to CVE‑2026‑46817, and restrict service usage to authenticated users only.

  6. Verification steps: 1) Attempt a request without auth; confirm it is denied. 2) Logs show 403/401 and no escalation. 3) Confirm patch installation and that the vulnerability record is marked resolved. 4) Run a scan (e.g., Nessus) targeting the Payments service to verify no CVE‑2026‑46817 findings remain.