Fortinet Patches Critical FortiSandbox and FortiManager Command-Execution Flaws

Fortinet issued multiple 2026 security advisories covering a broad set of vulnerabilities across FortiSandbox, FortiManager, FortiAnalyzer, FortiOS, FortiAP, FortiProxy, FortiPAM, FortiSwitchManager, FortiSwitchAXFixed, and related cloud offerings. The most severe flaws affect FortiSandbox, including CVE-2026-39808, an unauthenticated OS command injection bug that could allow arbitrary command execution and full device compromise, CVE-2026-39813, a path traversal issue in the JRPC API that may enable authentication bypass and privilege escalation, and CVE-2026-26083, a missing authorization flaw that can expose restricted functionality and sensitive sandbox analysis data through the GUI without authentication. National cyber authorities in Canada and Belgium separately warned organizations to apply Fortinet’s fixes immediately.

Fortinet also disclosed high-risk issues in management platforms, notably CVE-2025-54820, a stack-based buffer overflow in the FortiManager fgtupdates service that can let remote unauthenticated attackers execute unauthorized commands when the service is enabled, as well as a heap-based buffer overflow affecting FortiAnalyzer Cloud and FortiManager Cloud. Additional weaknesses across the product line include authentication and MFA bypasses, SQL injection, API denial of service, CLI command injection in FortiAP, CAPWAP daemon memory corruption in FortiOS, stored and reflected XSS, improper access control, and credential exposure. Fortinet advised customers to upgrade to fixed releases, disable exposed services such as fgtupdates where possible, restrict CLI, SSH, and API access, and monitor logs for anomalous authentication, privilege escalation, and endpoint activity.