Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs

Part of the CVE-2026-39808 story · since 15 Apr

Quiet for 3 weekslast report 12 Oct12 articles7 outlets
15 Apr · SecurityWeek first25 Jul28 Aug1 OctNowThis article4th of 12
  • Wed 15 Apr, 09:56 UTC. SecurityWeek, first report. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs. Cites a CVE in CISA KEV.
  • Wed 15 Apr, 14:04 UTC. The Hacker News, its first report on the story. Exploiters target SAP SQLi and Adobe zero day flaws in April. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 14:28 UTC. Security Affairs, its first report on the story. Fortinet warns of active exploits in unpatched FortiSandbox flaws. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:21 UTC. SecurityWeek. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs. Cites a CVE in CISA KEV. This article, 4th of 12.
  • Wed 17 Jun, 13:11 UTC. SOCRadar, its first report on the story. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code. Cites a CVE in CISA KEV.
  • Thu 16 Jul, 17:40 UTC. CISA, its first report on the story. CISA Adds CVE-2026-39808 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Thu 16 Jul, 18:39 UTC. CISA. CISA adds FortiSandbox flaw CVE-2026-39808 to KEV catalogue. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 04:50 UTC. SecurityOnline, its first report on the story. CISA orders urgent patches for SharePoint, FortiSandbox flaws. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 10:01 UTC. SecurityOnline. 292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 10:01 UTC. Infosecurity, its first report on the story. CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities. Cites a CVE in CISA KEV.
  • Sat 18 Jul, 12:51 UTC. Security Affairs. CISA urges patch of FortiSandbox, SharePoint flaws amid exploits. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.

Three newly patched vulnerabilities in Fortinet's FortiSandbox, rated critical, are actively being exploited. Defused's honeypots detected attempts targeting CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089. CVE-2026-39808 allows authentication bypass, while CVE-2026-39813 enables OS command injection for arbitrary code execution. CVE-2026-25089 permits remote command execution by unauthenticated attackers.

Additionally, SOCRadar revealed over 30,000 Fortinet firewalls were compromised through a campaign called 'FortiBleed', affecting networks globally, mostly in India and the U.S. Attackers gathered verified credentials and monitored traffic, indicating a sophisticated and self-sustaining hacking operation.

How the story developed

All 12 articles
Quiet for 3 weekslast report 12 Oct12 articles7 outlets

12 articles from 7 outlets since 15 Apr. Quiet since 12 Oct. This was the 4th report, 63 days after the first.

Now15 Apr15 Jun24306111610 Oct1925First reportSecurityWeek · 15 Apr, 09:56This article4th of 12 · day 63CISA alert16 Jul, 17:40 · official
  • Wed 15 Apr, 09:56 UTC. SecurityWeek, first report. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs. Cites a CVE in CISA KEV.
  • Wed 15 Apr, 14:04 UTC. The Hacker News, its first report on the story. Exploiters target SAP SQLi and Adobe zero day flaws in April. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 14:28 UTC. Security Affairs, its first report on the story. Fortinet warns of active exploits in unpatched FortiSandbox flaws. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:21 UTC. SecurityWeek. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs. Cites a CVE in CISA KEV. This article, 4th of 12.
  • Wed 17 Jun, 13:11 UTC. SOCRadar, its first report on the story. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code. Cites a CVE in CISA KEV.
  • Thu 16 Jul, 17:40 UTC. CISA, its first report on the story. CISA Adds CVE-2026-39808 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Thu 16 Jul, 18:39 UTC. CISA. CISA adds FortiSandbox flaw CVE-2026-39808 to KEV catalogue. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 04:50 UTC. SecurityOnline, its first report on the story. CISA orders urgent patches for SharePoint, FortiSandbox flaws. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 10:01 UTC. SecurityOnline. 292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 10:01 UTC. Infosecurity, its first report on the story. CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities. Cites a CVE in CISA KEV.
  • Sat 18 Jul, 12:51 UTC. Security Affairs. CISA urges patch of FortiSandbox, SharePoint flaws amid exploits. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Wed 15 AprDay 02
    1. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs09:56 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
    2. Exploiters target SAP SQLi and Adobe zero day flaws in April14:04 · The Hacker News · Known exploited CVE

  2. Quiet for 9 weeks

    Tue 16 JunDay 621
    1. Fortinet warns of active exploits in unpatched FortiSandbox flaws14:28 · Security Affairs · Picked up again · Known exploited CVE
  3. Wed 17 JunDay 632
    1. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs07:21 · SecurityWeek · Known exploited CVE · This article, 4th of 12
    2. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code13:11 · SOCRadar · Known exploited CVE

  4. Quiet for 4 weeks

    Thu 16 JulDay 922
    1. CISA Adds CVE-2026-39808 to Known Exploited Vulnerabilities Catalogue17:40 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA adds FortiSandbox flaw CVE-2026-39808 to KEV catalogue18:39 · CISA · official · Known exploited CVE
  5. Fri 17 JulDay 933
    1. CISA orders urgent patches for SharePoint, FortiSandbox flaws04:50 · SecurityOnline · Known exploited CVE
    2. 292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users10:01 · SecurityOnline · Known exploited CVE
    3. CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities10:01 · Infosecurity · Known exploited CVE
  6. Sat 18 JulDay 941
    1. CISA urges patch of FortiSandbox, SharePoint flaws amid exploits12:51 · Security Affairs · Known exploited CVE

  7. Quiet for 12 weeks

    Mon 12 OctDay 1801
    1. Actively Exploited Vulnerabilities Jump to 100 in Q3 202604:01 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in