Loading story…
CISA warned that two critical FortiSandbox vulnerabilities, CVE-2026-39808 and CVE-2026-25089, are being actively exploited and added both flaws to its Known Exploited Vulnerabilities catalog. The bugs are OS command injection issues rated CVSS 9.1 that affect FortiSandbox appliances and related cloud offerings, with CVE-2026-25089 reported to allow unauthenticated command execution through crafted HTTP requests.
Fortinet issued fixes in FortiSandbox 4.4.9 for both vulnerabilities and in 5.0.6 for CVE-2026-25089, while CISA directed U.S. federal agencies to remediate affected systems within days and told organizations using impacted cloud-based services to discontinue use if mitigations were not available. One related industry report also pointed to broader concern around unauthenticated flaws affecting network and security infrastructure, including firewalls, VPNs, switches, and load balancers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-39808 and CVE-2026-25089 to its Known Exploited Vulnerabilities catalog after warning they had been exploited in the wild. Both vulnerabilities are critical OS command injection flaws with CVSS scores of 9.1.
Fortinet disclosed CVE-2026-25089, an OS command injection vulnerability affecting multiple FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS versions. Fortinet released patches in FortiSandbox 4.4.9 and 5.0.6.
Fortinet disclosed CVE-2026-39808, an OS command injection flaw affecting FortiSandbox 4.4.0 through 4.4.8. The issue was detected by Samuel de Lucas Maroto of KPMG Spain, and Fortinet made a fix available in version 4.4.9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
eclypsium.com
Open sourceinfosecurity-magazine.com
Open sourcecve.org
Open sourcegov.br
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **Fortinet FortiSandbox** vulnerabilities `CVE-2026-25089` and `CVE-2026-39808` to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, elevating urgency around two critical unauthenticated OS command injection bugs that can be triggered through crafted HTTP requests. The flaws affect multiple **FortiSandbox**, **FortiSandbox Cloud**, and **FortiSandbox PaaS** versions and can allow arbitrary command execution, creating a path to full remote compromise of sandbox appliances that many organizations rely on for malware analysis and detection workflows. Fortinet published a PSIRT advisory for the issue, while third-party reporting said exploitation attempts were observed in June before the KEV listing. Available fixes include **FortiSandbox 5.0.6** and **4.4.9**, and CISA has ordered federal civilian agencies to remediate the vulnerabilities on an accelerated timeline under its binding directives. Security researchers warned that a compromised FortiSandbox deployment could create a dangerous detection blind spot while also giving attackers a foothold deeper inside enterprise networks.
Jul 17, 2026
Attackers are actively exploiting three critical FortiSandbox vulnerabilities—`CVE-2026-39813`, `CVE-2026-39808`, and `CVE-2026-25089`—to compromise exposed appliances through crafted HTTP requests. The flaws affect FortiSandbox `4.4.0` through `4.4.8` and `5.0.0` through `5.0.5`, while `CVE-2026-25089` also impacts FortiSandbox Cloud and FortiSandbox PaaS `5.0.4` through `5.0.5`. Reported attack chains include path traversal leading to authentication bypass and OS command injection enabling arbitrary command execution, with all three issues carrying a `CVSS 9.1` severity rating. Fortinet issued fixes for `CVE-2026-39813` and `CVE-2026-39808` in April and patched `CVE-2026-25089` in a broader June security update that also covered other Fortinet products, including FortiOS, FortiProxy, and FortiPortal. Remediation is available in FortiSandbox `4.4.9`, `5.0.6`, and `5.2.0` or later, and organizations were urged to deploy updates quickly after testing because a FortiSandbox compromise could corrupt threat verdicts consumed by other Fortinet security products and weaken defenses across the wider Fortinet ecosystem.
Jul 10, 2026
Fortinet disclosed two critical vulnerabilities in **FortiSandbox** that allow remote, unauthenticated attackers to compromise exposed appliances through crafted HTTP requests. **`CVE-2026-39808`** is an OS command injection flaw in the FortiSandbox API that can lead to unauthorized command or code execution, while **`CVE-2026-39813`** is a path traversal issue in the JRPC API that can bypass authentication and enable privilege escalation. Both issues carry a **CVSS v3 score of 9.1**. The flaws affect **FortiSandbox 4.4.0 through 4.4.8**, and **`CVE-2026-39813`** also impacts **5.0.0 through 5.0.5**. Fortinet released fixes in **4.4.9** for both vulnerabilities and **5.0.6** for the JRPC issue, and said it had not observed exploitation in the wild at the time of disclosure. Organizations were urged to patch immediately, review internet-exposed deployments, and restrict API access to trusted networks until upgrades are completed.
Jun 29, 2026