"We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours," Defused wrote in a LinkedIn post on Monday.
CVE-2026-39813: path traversal and authentication bypass
One of the trio of critical bugs, CVE-2026-39813, is a path traversal flaw in the FortiSandbox JRPC API that permits an authentication bypass through specially crafted HTTP requests. The vulnerability carries a 9.1 CVSS rating and affects FortiSandbox releases 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5. Fortinet patched this bug in April; the vendor’s remediation requires upgrading to FortiSandbox 4.4.9 or 5.0.6+, depending on branch. Fortinet security analyst Loic Pantano is credited with discovering and reporting CVE-2026-39813.
CVE-2026-39808: unauthenticated OS command injection
CVE-2026-39808 is an OS command injection weakness in FortiSandbox that allows unauthenticated attackers to execute unauthorized code or commands via HTTP requests. Also scored 9.1, it affects FortiSandbox 4.4.0 through 4.4.8. Fortinet issued a patch in April; upgrading to FortiSandbox 4.4.9 or above resolves the condition. The vendor credited Samuel de Lucas Maroto of KPMG Spain with reporting this vulnerability.
CVE-2026-25089: WEB UI command execution across FortiSandbox editions
The third flaw, CVE-2026-25089, is another OS command injection vulnerability that impacts FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI. Affected builds include FortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5. Fortinet patched this CVE last week; upgrading to the vendor’s fixed versions is the prescribed remedy. Like the other two, CVE-2026-25089 carries a 9.1 CVSS score.
Defused’s timeline and exploit status
Defused, a threat-intelligence firm, reported active exploitation of the three FortiSandbox flaws after observing attacks begin "over the weekend." The company said that, per its research, "a working exploit for CVE-2026-25089 has not yet been publicly disclosed," and that the exploit observed for this flaw "appeared to be vibe coded and may be faulty." Defused posted its findings on LinkedIn on Monday. The Register’s reporting notes that when Fortinet released patches earlier, the vendor said there were no reports of active exploitation at that time; Fortinet did not respond to The Register’s inquiries about these CVEs or whether the vendor had observed attacks.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: These vulnerabilities allow unauthenticated command execution and authentication bypasses against specific FortiSandbox branches; the technical fix is to upgrade to the patched builds identified for each CVE. Given the 9.1 CVSS ratings and Defused’s reporting of active exploitation, teams running affected versions should prioritize patching.
- Affected enterprises and procurement leaders: FortiSandbox 4.4.x and 5.0.x customers should inventory deployments against the exact vulnerable builds named above and apply the vendor updates to 4.4.9+, 5.0.6+, or the corresponding Cloud/PaaS fixes as provided.
- Adversaries and opportunistic attackers: Defused’s observation that at least one exploit appears to be "vibe coded" and possibly faulty does not preclude functional exploits elsewhere; the firm’s confirmation of exploitation over a single weekend signals active interest from unknown attackers in Fortinet sandbox flaws.
Earlier this month The Register also noted that Check Point VP of research Lotem Finkelstein warned ransomware actors had exploited a critical authentication bypass affecting Fortinet Remote Access VPN and Mobile Access deployments, and that the same crew was likely abusing other VPN-related vulnerabilities in Fortinet products. That earlier warning, combined with Defused’s new observations about FortiSandbox, places multiple Fortinet products and versions under focused scrutiny.
All three FortiSandbox bugs are patched; the practical question defenders now face is how rapidly operators will inventory and remediate exposed appliances and whether Fortinet will provide additional telemetry about the scope of active exploitation. For organizations that still run the affected FortiSandbox builds, the immediate step is simple and urgent: upgrade to the fixed versions specified for each CVE.
Source: The Register — Three critical Fortinet sandbox bugs splattered by unknown attackers
