Loading story…
CISA added Fortinet FortiSandbox vulnerabilities CVE-2026-25089 and CVE-2026-39808 to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, elevating urgency around two critical unauthenticated OS command injection bugs that can be triggered through crafted HTTP requests. The flaws affect multiple FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS versions and can allow arbitrary command execution, creating a path to full remote compromise of sandbox appliances that many organizations rely on for malware analysis and detection workflows.
Fortinet published a PSIRT advisory for the issue, while third-party reporting said exploitation attempts were observed in June before the KEV listing. Available fixes include FortiSandbox 5.0.6 and 4.4.9, and CISA has ordered federal civilian agencies to remediate the vulnerabilities on an accelerated timeline under its binding directives. Security researchers warned that a compromised FortiSandbox deployment could create a dangerous detection blind spot while also giving attackers a foothold deeper inside enterprise networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Security Online reported that Defused observed exploitation attempts against CVE-2026-25089 and CVE-2026-39808 in June. At that time, Fortinet had not confirmed in-the-wild exploitation.
On July 16, 2026, CISA added CVE-2026-25089 and CVE-2026-39808 to its Known Exploited Vulnerabilities catalog, identifying them as actively exploited. Reporting notes that patches were already available and federal agencies were required to remediate under Binding Operational Directive requirements.
Fortinet published PSIRT advisory FG-IR-26-146 covering the FortiSandbox vulnerabilities CVE-2026-25089 and CVE-2026-39808. The advisory corresponds to fixes available for affected FortiSandbox products.
Fortinet had already issued fixes for the FortiSandbox flaws later tracked as CVE-2026-39808 and CVE-2026-25089. The reference states the patches were released on April 14 and June 9, before CISA added the bugs to the KEV catalog.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcethreataft.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourcefortiguard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting three critical FortiSandbox vulnerabilities—`CVE-2026-39813`, `CVE-2026-39808`, and `CVE-2026-25089`—to compromise exposed appliances through crafted HTTP requests. The flaws affect FortiSandbox `4.4.0` through `4.4.8` and `5.0.0` through `5.0.5`, while `CVE-2026-25089` also impacts FortiSandbox Cloud and FortiSandbox PaaS `5.0.4` through `5.0.5`. Reported attack chains include path traversal leading to authentication bypass and OS command injection enabling arbitrary command execution, with all three issues carrying a `CVSS 9.1` severity rating. Fortinet issued fixes for `CVE-2026-39813` and `CVE-2026-39808` in April and patched `CVE-2026-25089` in a broader June security update that also covered other Fortinet products, including FortiOS, FortiProxy, and FortiPortal. Remediation is available in FortiSandbox `4.4.9`, `5.0.6`, and `5.2.0` or later, and organizations were urged to deploy updates quickly after testing because a FortiSandbox compromise could corrupt threat verdicts consumed by other Fortinet security products and weaken defenses across the wider Fortinet ecosystem.
Jul 10, 2026
Fortinet disclosed two critical vulnerabilities in **FortiSandbox** that allow remote, unauthenticated attackers to compromise exposed appliances through crafted HTTP requests. **`CVE-2026-39808`** is an OS command injection flaw in the FortiSandbox API that can lead to unauthorized command or code execution, while **`CVE-2026-39813`** is a path traversal issue in the JRPC API that can bypass authentication and enable privilege escalation. Both issues carry a **CVSS v3 score of 9.1**. The flaws affect **FortiSandbox 4.4.0 through 4.4.8**, and **`CVE-2026-39813`** also impacts **5.0.0 through 5.0.5**. Fortinet released fixes in **4.4.9** for both vulnerabilities and **5.0.6** for the JRPC issue, and said it had not observed exploitation in the wild at the time of disclosure. Organizations were urged to patch immediately, review internet-exposed deployments, and restrict API access to trusted networks until upgrades are completed.
Jun 29, 2026
Fortinet released multiple security advisories covering **FortiSandbox**, **FortiOS**, **FortiProxy**, **FortiPAM**, and **FortiAuthenticator**, with the most serious issue tracked as **`CVE-2026-59835`**. The high-severity FortiSandbox flaw, rated **CVSS 7.7** and classified as **`CWE-668`**, allows unauthenticated attackers to access the VNC server of malware-analysis virtual machines over the network, potentially exposing analysis sessions and interfering with sandbox operations. Fortinet said affected FortiSandbox versions are **5.0.0 through 5.0.2** and **4.4.3 through 4.4.8**, while **5.2** and **FortiSandbox PaaS** are not affected; no in-the-wild exploitation has been reported. The broader advisory set also addressed additional weaknesses including **`CVE-2026-59839`**, which could allow an authenticated CLI user to delete files from the root filesystem, along with lower-severity CRLF injection, path traversal, reflected XSS, buffer over-read, stack-based buffer overflow, and a FortiAuthenticator GUI out-of-bounds read affecting versions **6.6.0 through 6.6.2** and **6.5.0 through 6.5.7**. Canada’s Cyber Centre echoed the vendor notice and urged administrators to review the advisories and apply updates, particularly because several affected Fortinet products are commonly deployed in enterprise and internet-facing security environments.
Jul 15, 2026