Fortinet PSIRT Monthly Advisories — June 2026

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.1
  CVE-2026-25089 Exploited Public exploit A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiS…
  EPSS 76%

All vulnerabilities 3