Loading story…
Fortinet disclosed two critical vulnerabilities in FortiSandbox that allow remote, unauthenticated attackers to compromise exposed appliances through crafted HTTP requests. CVE-2026-39808 is an OS command injection flaw in the FortiSandbox API that can lead to unauthorized command or code execution, while CVE-2026-39813 is a path traversal issue in the JRPC API that can bypass authentication and enable privilege escalation. Both issues carry a CVSS v3 score of 9.1.
The flaws affect FortiSandbox 4.4.0 through 4.4.8, and CVE-2026-39813 also impacts 5.0.0 through 5.0.5. Fortinet released fixes in 4.4.9 for both vulnerabilities and 5.0.6 for the JRPC issue, and said it had not observed exploitation in the wild at the time of disclosure. Organizations were urged to patch immediately, review internet-exposed deployments, and restrict API access to trusted networks until upgrades are completed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Fortinet said CVE-2026-39808 is fixed in FortiSandbox 4.4.9, while CVE-2026-39813 is fixed in versions 4.4.9 and 5.0.6. The company also stated it had not observed exploitation in the wild at disclosure time and urged customers to patch, review exposed deployments, and restrict API access to trusted networks as an interim mitigation.
On 2026-04-14, Fortinet disclosed CVE-2026-39808 and CVE-2026-39813, two critical FortiSandbox flaws rated CVSS 9.1 that can be exploited remotely without authentication via crafted HTTP requests. The issues affect FortiSandbox 4.4.x, and CVE-2026-39813 also affects versions 5.0.0 through 5.0.5.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcerunzero.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting three critical FortiSandbox vulnerabilities—`CVE-2026-39813`, `CVE-2026-39808`, and `CVE-2026-25089`—to compromise exposed appliances through crafted HTTP requests. The flaws affect FortiSandbox `4.4.0` through `4.4.8` and `5.0.0` through `5.0.5`, while `CVE-2026-25089` also impacts FortiSandbox Cloud and FortiSandbox PaaS `5.0.4` through `5.0.5`. Reported attack chains include path traversal leading to authentication bypass and OS command injection enabling arbitrary command execution, with all three issues carrying a `CVSS 9.1` severity rating. Fortinet issued fixes for `CVE-2026-39813` and `CVE-2026-39808` in April and patched `CVE-2026-25089` in a broader June security update that also covered other Fortinet products, including FortiOS, FortiProxy, and FortiPortal. Remediation is available in FortiSandbox `4.4.9`, `5.0.6`, and `5.2.0` or later, and organizations were urged to deploy updates quickly after testing because a FortiSandbox compromise could corrupt threat verdicts consumed by other Fortinet security products and weaken defenses across the wider Fortinet ecosystem.
Jul 10, 2026
CISA added **Fortinet FortiSandbox** vulnerabilities `CVE-2026-25089` and `CVE-2026-39808` to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, elevating urgency around two critical unauthenticated OS command injection bugs that can be triggered through crafted HTTP requests. The flaws affect multiple **FortiSandbox**, **FortiSandbox Cloud**, and **FortiSandbox PaaS** versions and can allow arbitrary command execution, creating a path to full remote compromise of sandbox appliances that many organizations rely on for malware analysis and detection workflows. Fortinet published a PSIRT advisory for the issue, while third-party reporting said exploitation attempts were observed in June before the KEV listing. Available fixes include **FortiSandbox 5.0.6** and **4.4.9**, and CISA has ordered federal civilian agencies to remediate the vulnerabilities on an accelerated timeline under its binding directives. Security researchers warned that a compromised FortiSandbox deployment could create a dangerous detection blind spot while also giving attackers a foothold deeper inside enterprise networks.
Jul 17, 2026
Fortinet released fixes for two **critical** vulnerabilities that could let remote, unauthenticated attackers run unauthorized code or commands on exposed systems. The first, **`CVE-2026-44277`**, is an improper access control flaw in **FortiAuthenticator** with a **CVSS 9.1** rating; it affects versions **8.0.0**, **8.0.2**, **6.6.0-6.6.8**, and **6.5.0-6.5.6**, and was patched in **8.0.3**, **6.6.9**, and **6.5.7**. Fortinet said the issue stems from insufficient authorization checks on API endpoints and could allow unauthorized API access, privilege escalation, and command execution, while **FortiAuthenticator Cloud is not affected**. Fortinet also disclosed **`CVE-2026-26083`**, a **CVSS 9.1** missing-authorization flaw in the **FortiSandbox** Web UI that impacts **FortiSandbox**, **FortiSandbox Cloud**, and **FortiSandbox PaaS**, potentially enabling arbitrary code execution across on-premises and cloud deployments. Canada’s Cyber Centre warned that the advisories span multiple Fortinet products and urged administrators to review Fortinet PSIRT notices and apply updates promptly. Public reporting said Fortinet had not observed either flaw being exploited in the wild at disclosure, but the breadth of affected security infrastructure and Fortinet’s history of high-value exploitation have increased urgency around patching exposed appliances.
Jun 29, 2026