Key Takeaways
- Attackers are actively exploiting two critical FortiSandbox vulnerabilities (CVE‑2026‑39808 and CVE‑2026‑39813) that were patched by Fortinet in April.
- A third flaw, CVE‑2026‑25089, disclosed and patched on June 9, is also being targeted.
- Exploitation was first seen on June 9 (CVE‑2026‑39808) and later on June 11 and June 15 for the second vulnerability.
- Defused recorded 49 exploit attempts from 11 distinct IP addresses over a six‑day window, originating from nine countries across Asia, Europe, and North America.
- The observed activity consists mainly of verification and reconnaissance, which often precedes larger‑scale attacks.
- Exploits bypass authentication, escalate privileges, and allow arbitrary command execution, though researchers have not seen the vulnerabilities chained together.
- FortiSandbox is a high‑value target because it ingests data from and connects to other Fortinet security devices, potentially granting attackers elevated access to a trusted security zone.
- Organizations should apply the available patches immediately, restrict administrative access to FortiSandbox appliances, monitor for anomalous command execution, and consider network segmentation to limit lateral movement.
Overview of the FortiSandbox Vulnerabilities
Fortinet’s FortiSandbox is a security appliance designed to detect and analyze malicious files and URLs by executing them in an isolated environment. The product feeds threat intelligence to other Fortinet solutions, making it a trusted component of many enterprise security architectures. In April, Fortinet identified two critical security flaws affecting FortiSandbox: CVE‑2026‑39808, an OS‑command injection vulnerability, and CVE‑2026‑39813, a path‑traversal vulnerability. Both were assigned high severity scores and patches were released promptly, yet Fortinet has not publicly confirmed whether the flaws are being exploited in the wild.
Timeline of Discovery and Exploitation
Threat intelligence firm VulnCheck first observed active exploitation of CVE‑2026‑39808 on June 9, 2026. Researchers at Defused corroborated this finding on June 11 and, three days later on June 15, detected attempts to exploit CVE‑2026‑39813. The rapid succession of sightings suggests that attackers began probing the appliances shortly after the patches became available, possibly seeking unpatched or delayed‑update systems. Over a six‑day monitoring window, Defused logged 49 distinct exploitation events linked to these two CVEs.
Details of CVE‑2026‑39808 (OS‑Command Injection)
CVE‑2026‑39808 resides in the FortiSandbox web‑based management interface, where insufficient input validation allows an authenticated or, in some configurations, unauthenticated user to inject arbitrary operating‑system commands. By crafting a malicious request that includes shell metacharacters, an attacker can execute commands with the privileges of the FortiSandbox service account. This capability enables the installation of backdoors, exfiltration of captured malware samples, or the manipulation of sandbox analysis results to evade detection. The vulnerability’s nature makes it particularly attractive for attackers aiming to establish a foothold inside a trusted security device.
Details of CVE‑2026‑39813 (Path Traversal)
The second flaw, CVE‑2026‑39813, is a classic directory traversal issue affecting the appliance’s file‑handling routines. Insufficient sanitization of user‑supplied parameters permits an attacker to navigate outside the intended directory structure and read or write arbitrary files on the underlying filesystem. Exploitation can lead to the disclosure of configuration files, logs, or cryptographic keys, and it may also allow the overwriting of critical system binaries. When combined with privilege‑escalation techniques, path traversal can facilitate persistent access to the device.
Additional Vulnerability CVE‑2026‑25089
Beyond the two primary flaws, Defused noted that attackers are also probing CVE‑2026‑25089, a vulnerability disclosed and patched by Fortinet on June 9, 2026. While the advisory did not detail the exact nature of CVE‑2026‑25089, its inclusion in the exploitation timeline indicates that threat actors are casting a wide net, attempting to leverage any recently patched FortiSandbox weakness before administrators have had a chance to apply fixes. This behavior underscores the importance of rapid patch deployment and vigilant monitoring for scanning activity.
Exploitation Activity and Observations
The exploitation patterns observed by Defused and VulnCheck consist largely of verification and reconnaissance steps: attackers send crafted requests to determine whether the device is vulnerable, then attempt to execute benign commands (such as id or whoami) to confirm successful code execution. Such low‑noise activity is typical of early‑stage campaigns, where threat actors map the attack surface before launching more disruptive actions like data theft, ransomware deployment, or lateral movement within the victim’s network. The absence of observed chaining between CVE‑2026‑39808 and CVE‑2026‑39813 suggests that, at least for now, each vulnerability is being used independently to achieve initial access.
Geographic Distribution and Threat Actor Profile
Defused traced the malicious traffic to 13 distinct sources spread across nine countries: China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada, and Bulgaria. This geographically diverse set of origins, coupled with the observation that multiple proof‑of‑concept (PoC) scripts are being shared, leads analysts to conclude that the activity is not the work of a single, coordinated campaign. Instead, it appears to involve several independent operators leveraging commoditized infrastructure—such as compromised virtual private servers or botnet nodes—to scan and exploit FortiSandbox instances. The broad distribution increases the difficulty of attributing the attacks to a specific threat group and suggests a opportunistic, volume‑driven approach.
Potential Impact on Enterprises
Because FortiSandbox sits at the forefront of threat detection, a successful compromise can undermine an organization’s entire security posture. The appliance is typically trusted to analyze suspicious email attachments, web downloads, and network traffic; if attackers gain control, they can tamper with analysis results, allowing malware to bypass detection, or they can use the device as a pivot point to access other Fortinet products (e.g., FortiGate firewalls, FortiAnalyzer SIEM). Chris Doyle, Head of Security and Compliance at JupiterOne, emphasized that “sandbox appliances are typically trusted systems used to analyze suspicious content and support broader detection workflows, which means a compromise could provide attackers with elevated access within a security‑sensitive environment.” This elevated access can facilitate credential harvesting, internal reconnaissance, and the deployment of additional payloads deep inside the corporate network.
Mitigation and Recommendations
Fortinet has released patches for all three vulnerabilities; administrators should apply them immediately, prioritizing systems exposed to the internet or located in DMZ segments. In addition to patching, organizations should:
- Restrict management interface access to known administrative IP addresses via firewall rules.
- Enable multi‑factor authentication for administrative accounts.
- Monitor logs for anomalous command execution, unexpected file accesses, or repeated authentication failures.
- Consider network segmentation to isolate FortiSandbox from critical assets, limiting lateral movement if the device is compromised.
- Regularly review vulnerability advisories and subscribe to Fortinet’s security notifications to stay ahead of future threats.
Broader Context: Fortinet Vulnerabilities in CISA KEV
Since 2021, the Cybersecurity and Infrastructure Security Agency (CISA) has listed 26 Fortinet vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog. As of the article’s publication date, none of the newly disclosed flaws (CVE‑2026‑39808, CVE‑2026‑39813, CVE‑2026‑25089) have been added to that list, although continued exploitation could prompt future inclusion. The steady flow of Fortinet‑related KEV entries highlights the attractiveness of the vendor’s products to threat actors and reinforces the need for timely patch management and vigilant threat‑intelligence consumption.
Conclusion
The recent wave of exploitation targeting FortiSandbox underscores the importance of maintaining up‑to‑date defenses on security‑critical appliances. While the observed activity remains largely exploratory, the potential for escalation is significant given the device’s privileged role in enterprise threat detection. By applying patches promptly, tightening access controls, and enhancing monitoring for signs of abuse, organizations can mitigate the immediate risk and reduce the likelihood that attackers succeed in leveraging these vulnerabilities for more damaging operations. Continued vigilance, informed by threat‑intelligence feeds and industry advisories, remains essential in defending against evolving threats aimed at trusted security infrastructure.