Fortinet Warned as Three Critical FortiSandbox Bugs Come Under Attack


Fortinet Warned as Three Critical FortiSandbox Bugs Come Under Attack

Pierluigi Paganini
June 16, 2026

Cybersecurity firm Defused Cyber confirmed it’s seen active exploitation of three vulnerabilities in Fortinet FortiSandbox within a 24-hour window. Two of them had patches sitting available since April. The third got fixed last week, which, apparently, wasn’t fast enough.

CVE-2026-39813 (CVSS score: 9.1) is a path traversal vulnerability in FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. Its twin, CVE-2026-39808, carries the same severity score and is an OS command injection flaw, same attack vector, same result: unauthenticated code execution via crafted HTTP requests. Both had patches available for two months.

The third flaw, CVE-2026-25089, hits a broader surface. Fortinet described it as an operating system command injection impacting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI that could allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. The patch dropped last week, yet it’s already being used in the wild.

Here’s where it gets interesting. The exploit for CVE-2026-25089 appears to have been built with AI assistance, and it shows, not in a good way. Defused Cyber researchers speculate that the exploit for CVE-2026-25089 not only shows signs of being developed using an artificial intelligence (AI) model, but is also bugged. A working exploit for the vulnerability has not been publicly disclosed. So attackers are throwing broken AI-generated code at unpatched systems and still finding traction. That should tell you something about the state of patch management out there.

Fortinet gear keeps drawing this kind of attention. In April, the company pushed out-of-band patches for a critical flaw in FortiClient EMS, tracked as CVE-2026-35616, (CVSS score of 9.1) which was already being exploited before the fix arrived. If you run anything in the Fortinet stack, the window between disclosure and active exploitation has become uncomfortably short. Patch cycles measured in weeks are now measured in days.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fortinet)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Reaching people who have been let down so many times they’ve stopped expecting anything different takes time, consistency, and trust. The Winter Surge project does all these things and more.

Running every November to March for the past four years, the Winter Surge project – part of our Higher Needs Floating Support service – provides high support temporary accommodation for 17 beds, daily welfare checks, and intensive, trauma-informed care for Bristol’s most entrenched rough sleepers.

Commissioned by Bristol City Council as part of its cold weather provision, it brings together a powerful network of partners including St Mungo’s Outreach, Social Care, Homeless Health, drug and alcohol services and housing providers.

Team Manager Sam Scott has been involved in shaping the project from the start – from planning how it works and selecting temporary accommodation providers, to troubleshooting, managing risk, and feeding back learning to improve the service year-on-year. She says it has been a privilege:

Bristol City Council gave me the opportunity to run Winter Surge and the autonomy to shape it into what it’s become. From the planning stages right through to being on the ground – it’s an extraordinary project to be part of.”

A landmark year

This winter, 42 people came into the service and not one of them went back to the streets. This is the result of a small, skilled team of support workers focused on stabilisation, move-on planning, and wrap-around support covering mental health, safeguarding, benefits, addiction, and wellbeing. After the project ended on 31 March, the wider team makes sure clients move on from the service smoothly with no gap in care.

There are some truly amazing personal stories hidden behind the headline numbers. Four clients who had resisted support for years agreed to come in and stayed for the full duration. One man, who had been living with undiagnosed cancer for over three years, was supported by the team to access hospital treatment. He has now had two major operations and is receiving ongoing care. Sam said:

It’s our patient, trauma-informed relationship building that makes all the difference. I’m so proud of the team and the work we’ve done, particularly this year when not one person went back onto the streets.”

Building trust where it’s been broken

At the heart of the Winter Surge is a commitment to breaking the cycle that sees the most vulnerable people going through many services and feeling constantly let down. The project successfully reduced evictions, improved access to housing, rebuilt confidence in receiving support, and promoted a My Team Around Me approach, ensuring every agency took genuine ownership of their role in a client’s journey.

This is what person-centred, trauma-informed care looks like in practice, and this year it worked for every single person who walked through the door.

Image L-R: Amy O’Loughlin, Sam Scott, Emma Ireland



Source link