Summary
Attackers are actively exploiting three critical Fortinet FortiSandbox vulnerabilities — CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089 — all carrying CVSS scores of 9.1. The flaws include OS command injection and path-traversal bugs that allow remote, unauthenticated attackers to execute arbitrary code or bypass authentication on affected systems.
CVE-2026-39808, an OS command injection flaw affecting FortiSandbox versions 4.4.0 through 4.4.8, allows attackers to inject malicious commands into system operations without any user interaction. CVE-2026-39813 is a path-traversal vulnerability that enables authentication bypass, and CVE-2026-25089 is another OS command injection flaw. Threat intelligence firms VulnCheck and Defused confirmed active exploitation beginning in early June, with Defused pinpointing exploitation of CVE-2026-39808 as early as June 11, 2026.
Fortinet released patches for CVE-2026-39808 and CVE-2026-39813 back in April, with CVE-2026-25089 patched more recently in June. Organizations that delayed patching are now in the crosshairs.
Source
CyberScoop — Fortinet FortiSandbox Vulnerabilities Exploited · BleepingComputer — Critical FortiSandbox Flaws Now Exploited
Commentary
This is yet another reminder that the window between “patch available” and “actively exploited” continues to shrink. Fortinet patched two of these flaws in April, giving organizations over two months of lead time. Anyone still running unpatched FortiSandbox instances is now dealing with a weaponized threat, not a theoretical risk.
Fortinet appliances are perennial favorites for initial access brokers and ransomware groups alike. If your organization runs FortiSandbox, treat this as an emergency patching event. If you already patched, verify it — and check your logs for signs of exploitation dating back to early June.