"has observed exploitation of CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 over the past 24 hours," Defused Cyber said in a post shared on X.
Multiple FortiSandbox flaws being exploited, per Defused Cyber
Threat intelligence firm Defused Cyber reported that bad actors are actively exploiting three distinct Fortinet FortiSandbox vulnerabilities within a compressed timeframe. The three tracked identifiers are CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089. Each carries a CVSS score of 9.1, and Defused Cyber said it observed exploitation activity "over the past 24 hours."
CVE-2026-39813 and CVE-2026-39808 — high-severity flaws patched in April 2026
CVE-2026-39813 is described as a path traversal vulnerability in the FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication using specially crafted HTTP requests. CVE-2026-39808 is an operating-system command injection that could enable unauthenticated attackers to execute unauthorized code or commands via crafted HTTP requests. Fortinet issued patches for both of these vulnerabilities in April 2026.
CVE-2026-25089 — patched last week, exploit shows AI development signals but is faulty
Fortinet fixed CVE-2026-25089 "last week," characterizing it as an operating-system command injection affecting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI. Like the others, the flaw could allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Defused Cyber noted that the exploit observed for CVE-2026-25089 shows signs of having been developed using an artificial intelligence model, but the observed exploit is faulty. Importantly, a working exploit for CVE-2026-25089 "has not been publicly disclosed," according to the reporting.
Fortinet appliances as recurring targets — April 2026 FortiClient EMS patch
Vulnerabilities in Fortinet appliances have attracted attention before. In April 2026, Fortinet released out-of-band patches for a critical security flaw impacting FortiClient EMS (CVE-2026-35616, CVSS score: 9.1). Fortinet stated that CVE-2026-35616 "has been exploited in the wild." That recent history frames the current activity against FortiSandbox: multiple high-severity defects, rapid patching, and observed exploitation attempts in short order.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: Confirm that the April 2026 patches for CVE-2026-39813 and CVE-2026-39808 have been applied, and verify that the recent fix for CVE-2026-25089 is installed across FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI deployments.
- Affected enterprises and procurement leaders: Inventory any FortiSandbox-related assets and services to ensure coverage by the relevant patches; treat the presence of multiple high-severity CVEs with coordinated remediation and validation.
- Adversaries and threat actors: The observed exploit for CVE-2026-25089 indicates experimentation with AI-assisted exploit development, but the published sample is faulty and a working public exploit has not appeared.
Defused Cyber's 24‑hour observation underscores two competing realities: the defensive side has working patches in place for the three high-severity FortiSandbox flaws, yet attackers are actively testing or attempting exploitation. The record shows a faulty, apparently AI-derived attempt for CVE-2026-25089 and prior evidence that Fortinet appliances have been targeted and patched out-of-band. Whether adversaries will refine the faulty CVE-2026-25089 exploit into a reliable weapon — or publish a working proof-of-concept — remains the immediate operational question for defenders to watch.
