Recent reports indicate that threat actors are actively exploiting multiple critical vulnerabilities in Fortinet’s FortiSandbox platform. Over the past 24 hours, live attack telemetry has confirmed exploitation attempts targeting three specific vulnerabilities, including CVE-2026-39813, which had no prior recorded exploitation history.
Details of the Exploited Vulnerabilities
Honeypot sensors and deception infrastructure, masquerading as FortiSandbox instances, have captured exploitation attempts across the following vulnerabilities:
- CVE-2026-39813: This path traversal vulnerability (CWE-24) in the FortiSandbox JSON-RPC (JRPC) API allows unauthenticated remote attackers to bypass authentication via specially crafted HTTP requests. By injecting traversal sequences such as
session: "../../tmp/"into the API, attackers can access sensitive system data—including configuration backups, serial numbers, and version details—without any credentials. This marks the first recorded exploitation of this CVE in the wild. - CVE-2026-39808: An OS command injection flaw (CWE-78) in a FortiSandbox API endpoint enables unauthenticated attackers to execute arbitrary commands as the root user. A public proof-of-concept exploit has been available since April 2026, leveraging the
jidGET parameter with pipe-chained Unix commands. Recent attack payloads align with this proof-of-concept, indicating active exploitation. - CVE-2026-25089: Another OS command injection vulnerability (CWE-78) affecting the FortiSandbox Web UI across versions 5.0.0–5.0.5, 4.4.0–4.4.8, 4.2 (all versions), and FortiSandbox Cloud/PaaS deployments. Notably, no functional public exploit has been disclosed for this CVE. Observed exploitation attempts appear to be AI-assisted or heuristically generated exploits with faulty logic, suggesting opportunistic actors are probing without a validated working payload.
Affected Versions and Mitigation
The vulnerabilities affect the following FortiSandbox versions:
| CVE | Affected Versions | Fixed Version |
|---|---|---|
| CVE-2026-39813 | FortiSandbox 4.4.0–4.4.8, 5.0.0–5.0.5 | 4.4.9, 5.0.6+ |
| CVE-2026-39808 | FortiSandbox 4.4.0–4.4.8 | 4.4.9+ |
| CVE-2026-25089 | FortiSandbox 4.2 (all versions), 4.4.0–4.4.8, 5.0.0–5.0.5; Cloud/PaaS 5.0.4–5.0.5 | 4.4.9, 5.0.6+ |
All three vulnerabilities can be exploited without authentication through a single HTTP request, meaning exposed FortiSandbox management interfaces require no pre-existing access to be compromised. A compromised FortiSandbox can be weaponized to approve malicious files as clean to dependent Fortinet products or serve as a lateral movement pivot within enterprise networks.
Indicators of Compromise (IOCs)
Organizations should be vigilant for the following indicators of compromise:
- Attacker IP:
141.11.43.175(Observed exploit source) - ASN: AS136510 Streamline Servers Pty Ltd, Singapore
- Target Port: 443 (HTTPS/JRPC API)
- Target Endpoint:
/jsonrpc/(FortiSandbox API path) - User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36(Observed in live requests)
Given the critical nature of these vulnerabilities and their active exploitation, it is imperative for organizations using FortiSandbox to apply the latest patches immediately. Additionally, reviewing and securing management interfaces to prevent unauthorized access is crucial. This incident underscores the importance of proactive vulnerability management and continuous monitoring to defend against evolving cyber threats.
