Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Fortinet warns of active exploits in unpatched FortiSandbox flaws

Part of the CVE-2026-39813 story · since 15 Apr

Quiet for 20 weekslast report 17 Jun5 articles4 outlets
15 Apr · SecurityWeek first25 Jul28 Aug1 OctNowThis article3rd of 5
  • Wed 15 Apr, 09:56 UTC. SecurityWeek, first report. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs.
  • Wed 15 Apr, 14:04 UTC. The Hacker News, its first report on the story. Exploiters target SAP SQLi and Adobe zero day flaws in April.
  • Tue 16 Jun, 14:28 UTC. Security Affairs, its first report on the story. Fortinet warns of active exploits in unpatched FortiSandbox flaws. This article, 3rd of 5.
  • Wed 17 Jun, 07:21 UTC. SecurityWeek. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs.
  • Wed 17 Jun, 13:11 UTC. SOCRadar, its first report on the story. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code.

Fortinet is facing active exploitation of three critical vulnerabilities in its FortiSandbox software, confirmed by cybersecurity firm Defused Cyber. Two of these vulnerabilities were reportedly unpatched for two months, while the third had a patch released only the previous week. The vulnerabilities, CVE-2026-39813 and CVE-2026-39808, both have a CVSS score of 9.1 and allow unauthenticated code execution through specially crafted HTTP requests.

A third flaw, CVE-2026-25089, described as an OS command injection, is notable for having attacks that appear to be assisted by AI, although the exploit may also be flawed. The rapid exploitation of these vulnerabilities highlights issues in patch management within organizations using Fortinet products.

How the story developed

All 5 articles
Quiet for 20 weekslast report 17 Jun5 articles4 outlets

5 articles from 4 outlets since 15 Apr. Quiet since 17 Jun. This was the 3rd report, 62 days after the first.

Now15 Apr1615 Jun1719First reportSecurityWeek · 15 Apr, 09:56This article3rd of 5 · day 62
  • Wed 15 Apr, 09:56 UTC. SecurityWeek, first report. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs.
  • Wed 15 Apr, 14:04 UTC. The Hacker News, its first report on the story. Exploiters target SAP SQLi and Adobe zero day flaws in April.
  • Tue 16 Jun, 14:28 UTC. Security Affairs, its first report on the story. Fortinet warns of active exploits in unpatched FortiSandbox flaws. This article, 3rd of 5.
  • Wed 17 Jun, 07:21 UTC. SecurityWeek. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs.
  • Wed 17 Jun, 13:11 UTC. SOCRadar, its first report on the story. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Wed 15 AprDay 02
    1. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs09:56 · SecurityWeek · First report
    2. Exploiters target SAP SQLi and Adobe zero day flaws in April14:04 · The Hacker News

  2. Quiet for 9 weeks

    Tue 16 JunDay 621
    1. Fortinet warns of active exploits in unpatched FortiSandbox flaws14:28 · Security Affairs · Picked up again · This article, 3rd of 5
  3. Wed 17 JunDay 632
    1. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs07:21 · SecurityWeek
    2. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code13:11 · SOCRadar

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in