Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarAmeer Owda

FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code

Part of the CVE-2026-39813 story · since 15 Apr

Quiet for 20 weekslast report 17 Jun5 articles4 outlets
15 Apr · SecurityWeek first25 Jul28 Aug1 OctNowThis article5th of 5
  • Wed 15 Apr, 09:56 UTC. SecurityWeek, first report. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs.
  • Wed 15 Apr, 14:04 UTC. The Hacker News, its first report on the story. Exploiters target SAP SQLi and Adobe zero day flaws in April.
  • Tue 16 Jun, 14:28 UTC. Security Affairs, its first report on the story. Fortinet warns of active exploits in unpatched FortiSandbox flaws.
  • Wed 17 Jun, 07:21 UTC. SecurityWeek. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs.
  • Wed 17 Jun, 13:11 UTC. SOCRadar, its first report on the story. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code. This article, 5th of 5.

FortiSandbox has critical vulnerabilities (CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089) affecting its API and Web UI components, allowing attackers to bypass authentication, escalate privileges, and execute commands without valid credentials. These vulnerabilities have a CVSS score of 9.8, indicating high severity. Attackers can exploit these flaws via crafted HTTP requests, particularly targeting FortiSandbox deployments exposed to the internet.

Patching affected systems, restricting management access, and reviewing logs for suspicious requests are essential immediate actions for security teams. Historical data indicates that exploitation of these vulnerabilities has been observed.

How the story developed

All 5 articles
Quiet for 20 weekslast report 17 Jun5 articles4 outlets

5 articles from 4 outlets since 15 Apr. Quiet since 17 Jun. This was the 5th report, 63 days after the first.

Now15 Apr1615 Jun1719First reportSecurityWeek · 15 Apr, 09:56This article5th of 5 · day 63
  • Wed 15 Apr, 09:56 UTC. SecurityWeek, first report. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs.
  • Wed 15 Apr, 14:04 UTC. The Hacker News, its first report on the story. Exploiters target SAP SQLi and Adobe zero day flaws in April.
  • Tue 16 Jun, 14:28 UTC. Security Affairs, its first report on the story. Fortinet warns of active exploits in unpatched FortiSandbox flaws.
  • Wed 17 Jun, 07:21 UTC. SecurityWeek. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs.
  • Wed 17 Jun, 13:11 UTC. SOCRadar, its first report on the story. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code. This article, 5th of 5.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Wed 15 AprDay 02
    1. Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs09:56 · SecurityWeek · First report
    2. Exploiters target SAP SQLi and Adobe zero day flaws in April14:04 · The Hacker News

  2. Quiet for 9 weeks

    Tue 16 JunDay 621
    1. Fortinet warns of active exploits in unpatched FortiSandbox flaws14:28 · Security Affairs · Picked up again
  3. Wed 17 JunDay 632
    1. 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs07:21 · SecurityWeek
    2. FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code13:11 · SOCRadar · This article, 5th of 5

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in