THREE newly patched vulnerabilities in Fortinet's FortiSandbox, rated critical, are actively being exploited. Defused's honeypots detected attempts targeting CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089. CVE-2026-39808 allows authentication bypass, while CVE-2026-39813 enables OS command injection for arbitrary code execution. CVE-2026-25089 permits remote command execution by unauthenticated attackers.
Additionally, SOCRadar revealed over 30,000 Fortinet firewalls were compromised through a campaign called 'FortiBleed', affecting networks globally, mostly in India and the U.S. Attackers gathered verified credentials and monitored traffic, indicating a sophisticated and self-sustaining hacking operation.