Loading story…
Attackers are actively exploiting three critical FortiSandbox vulnerabilities—CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089—to compromise exposed appliances through crafted HTTP requests. The flaws affect FortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5, while CVE-2026-25089 also impacts FortiSandbox Cloud and FortiSandbox PaaS 5.0.4 through 5.0.5. Reported attack chains include path traversal leading to authentication bypass and OS command injection enabling arbitrary command execution, with all three issues carrying a CVSS 9.1 severity rating.
Fortinet issued fixes for CVE-2026-39813 and CVE-2026-39808 in April and patched CVE-2026-25089 in a broader June security update that also covered other Fortinet products, including FortiOS, FortiProxy, and FortiPortal. Remediation is available in FortiSandbox 4.4.9, 5.0.6, and 5.2.0 or later, and organizations were urged to deploy updates quickly after testing because a FortiSandbox compromise could corrupt threat verdicts consumed by other Fortinet security products and weaken defenses across the wider Fortinet ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-16, ThreatAft reported that three critical FortiSandbox vulnerabilities were being actively exploited in the wild. The report noted Fortinet had patched CVE-2026-39813 and CVE-2026-39808 in April 2026 and CVE-2026-25089 in June 2026, with fixes available in versions 4.4.9, 5.0.6, and 5.2.0 or later.
Defused reported observing active exploitation of three FortiSandbox vulnerabilities—CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089—during a 24-hour period beginning over the weekend. The attacks used crafted HTTP requests to achieve authentication bypass and OS command injection.
On 2026-06-10, Ivanti released security updates for Endpoint Manager Mobile and Ivanti Sentry to remediate multiple vulnerabilities. The update addressed critical flaws including CVE-2026-10520 and CVE-2026-10523 affecting supported and earlier versions listed in the advisory.
On 2026-06-10, Fortinet released security updates for multiple products, including a fix for FortiSandbox vulnerability CVE-2026-25089. The updates covered FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS, FortiOS, FortiProxy, and FortiPortal.
On 2026-06-09, Apache released a security update for Apache HTTP Server to fix multiple vulnerabilities affecting version 2.4.67 and earlier, including CVE-2026-44631 and CVE-2026-29170. The issues were addressed in version 2.4.68.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourceegfincirt-wpn.azurewebsites.net
Open sourcezeropath.com
Open sourceegfincirt.org.eg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed two critical vulnerabilities in **FortiSandbox** that allow remote, unauthenticated attackers to compromise exposed appliances through crafted HTTP requests. **`CVE-2026-39808`** is an OS command injection flaw in the FortiSandbox API that can lead to unauthorized command or code execution, while **`CVE-2026-39813`** is a path traversal issue in the JRPC API that can bypass authentication and enable privilege escalation. Both issues carry a **CVSS v3 score of 9.1**. The flaws affect **FortiSandbox 4.4.0 through 4.4.8**, and **`CVE-2026-39813`** also impacts **5.0.0 through 5.0.5**. Fortinet released fixes in **4.4.9** for both vulnerabilities and **5.0.6** for the JRPC issue, and said it had not observed exploitation in the wild at the time of disclosure. Organizations were urged to patch immediately, review internet-exposed deployments, and restrict API access to trusted networks until upgrades are completed.
Jun 29, 2026
CISA added **Fortinet FortiSandbox** vulnerabilities `CVE-2026-25089` and `CVE-2026-39808` to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, elevating urgency around two critical unauthenticated OS command injection bugs that can be triggered through crafted HTTP requests. The flaws affect multiple **FortiSandbox**, **FortiSandbox Cloud**, and **FortiSandbox PaaS** versions and can allow arbitrary command execution, creating a path to full remote compromise of sandbox appliances that many organizations rely on for malware analysis and detection workflows. Fortinet published a PSIRT advisory for the issue, while third-party reporting said exploitation attempts were observed in June before the KEV listing. Available fixes include **FortiSandbox 5.0.6** and **4.4.9**, and CISA has ordered federal civilian agencies to remediate the vulnerabilities on an accelerated timeline under its binding directives. Security researchers warned that a compromised FortiSandbox deployment could create a dangerous detection blind spot while also giving attackers a foothold deeper inside enterprise networks.
Jul 17, 2026
Fortinet released multiple security advisories covering **FortiSandbox**, **FortiOS**, **FortiProxy**, **FortiPAM**, and **FortiAuthenticator**, with the most serious issue tracked as **`CVE-2026-59835`**. The high-severity FortiSandbox flaw, rated **CVSS 7.7** and classified as **`CWE-668`**, allows unauthenticated attackers to access the VNC server of malware-analysis virtual machines over the network, potentially exposing analysis sessions and interfering with sandbox operations. Fortinet said affected FortiSandbox versions are **5.0.0 through 5.0.2** and **4.4.3 through 4.4.8**, while **5.2** and **FortiSandbox PaaS** are not affected; no in-the-wild exploitation has been reported. The broader advisory set also addressed additional weaknesses including **`CVE-2026-59839`**, which could allow an authenticated CLI user to delete files from the root filesystem, along with lower-severity CRLF injection, path traversal, reflected XSS, buffer over-read, stack-based buffer overflow, and a FortiAuthenticator GUI out-of-bounds read affecting versions **6.6.0 through 6.6.2** and **6.5.0 through 6.5.7**. Canada’s Cyber Centre echoed the vendor notice and urged administrators to review the advisories and apply updates, particularly because several affected Fortinet products are commonly deployed in enterprise and internet-facing security environments.
Jul 15, 2026