Fortinet FortiSandbox Critical Flaws (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) Now Actively Exploited

Three unauthenticated critical flaws in Fortinet FortiSandbox, each scored CVSSv3 9.1, moved from advisory to observed exploitation within days. CVE-2026-39813 is a path traversal in the JRPC API (CWE-24) that yields authentication bypass and privilege escalation, disclosed April 14, 2026 in FG-IR-26-112. CVE-2026-39808 is OS command injection through an API endpoint (CWE-78), disclosed the same day in FG-IR-26-100. CVE-2026-25089, disclosed June 9, 2026 in FG-IR-26-141, is a second-order OS command injection via JSON input on the web UI's start VNC feature. Defused has recorded 49 exploitation events from 13 distinct IPs over six days, originating in China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria, with the three bugs functioning together for pre-auth RCE, privilege escalation and arbitrary command execution.

The product is what makes this story outrank routine Fortinet patch churn. A sandbox is the one box that receives, by design, every file an organization already suspects, so root on FortiSandbox hands an attacker a live map of what the victim fears, plus a position from which verdicts can be altered and malware laundered past the downstream controls that depend on sandbox judgments. The telemetry pattern, 13 IPs across nine countries in six days with multiple independent operators rather than a single campaign, points to a conclusion the event list leaves implicit: internet exposure of the management interface, not attacker targeting, is the dominant risk variable here, which means most victims could have opted out entirely with network controls alone. CISA counts 26 Fortinet vulnerabilities exploited in the wild since 2021, 13 of them ransomware-linked, yet none of these three is in KEV, and the two-month gap between the April 14 fixes and the June 15 exploitation start shows how that lag gets priced in by scanners.

The upgrade paths are explicit: FortiSandbox 5.0.x to 5.0.6 or above, 4.4.x to 4.4.9 or above, Cloud and PaaS 5.0.4 and 5.0.5 to 5.0.6 or above, and 5.2, which none of the three flaws affects. Version mapping matters for triage: CVE-2026-39808 hits only 4.4.x, while CVE-2026-39813 and CVE-2026-25089 cover both 5.0.x and 4.4.x, so inventory by branch determines which flaw applies, though the fixed version per branch is the same. Until patched, the GUI and API must not be reachable from the internet, or from anything beyond management subnets and the integrated Fortinet devices that legitimately submit samples. Hunt for unauthenticated HTTP requests hitting the JRPC API or the start VNC feature with malformed JSON bodies, bursts of requests from geographies with no business touching the box, new accounts or privilege changes created after June 9, and outbound connections from the sandbox to destinations that are neither update servers nor sample-submission endpoints.

Two developments would change this assessment. A CISA KEV listing for any of the three would confirm broader exploitation and impose federal remediation deadlines, and public proof that CVE-2026-39813's authentication bypass chains reliably with either command injection into a working unauthenticated RCE would collapse the current noisy-scanning picture into trivially repeatable compromise. Either one moves this from patch hygiene to emergency response for anyone still unpatched.