cyber.hendryadrian.com
Vulnerability & Exploit · cyberscoop.com

Researchers Report Active Exploitation of Patched FortiSandbox Flaws

· Original article ↗

Summary

Researchers reported active exploitation of FortiSandbox flaws CVE-2026-39808 and CVE-2026-39813, patched in April, and attempts against CVE-2026-25089. They observed 49 events from 11 IPs; Fortinet has not confirmed exploitation.

Key points

  • VulnCheck first observed exploitation of CVE-2026-39808 on June 9; Defused confirmed activity against it on June 11 and observed exploitation of CVE-2026-39813 on June 15.
  • Defused reported 49 exploitation events from 11 IPs against the two flaws over six days, with sources traced to nine countries.
  • Researchers also observed attempts to exploit CVE-2026-25089, which Fortinet disclosed and patched on June 9.
  • CVE-2026-39808 is an OS-command injection flaw; CVE-2026-39813 is a path-traversal flaw.
  • Researchers described activity including authentication bypass, privilege escalation, arbitrary command execution, verification, and reconnaissance; they had not determined how many customers were affected.
  • Researchers said they had not observed evidence of the vulnerabilities being chained and characterized the activity as involving multiple independent operators.
  • Fortinet has not confirmed exploitation. Researchers warned that compromising FortiSandbox could give attackers elevated access in a sensitive security environment.

Article Details

Vulnerability Types
  • OS-command injection
  • Path traversal
Severity
Critical
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe vulnerabilities reportedly allow attackers to execute arbitrary commands on FortiSandbox.T1068 · Exploitation for Privilege EscalationThe reported exploits elevate privileges in FortiSandbox.

CVE

CVE-2026-25089Fortinet · FortiSandbox; Fortinet · FortiSandbox Cloud; +1 more#FortinetCVE-2026-39808Fortinet · FortiSandbox; Fortinet · FortiSandbox PaaSAttackers are exploiting multiple Fortinet FortiSandbox flaws, including CVE-2026-39808 and CVE-2026-39813, after patches were released in April, with researchers observing active exploitation across several countries.CVE-2026-39813Fortinet · FortiSandbox; Fortinet · FortiSandbox CloudAttackers are exploiting multiple Fortinet FortiSandbox flaws, including CVE-2026-39808 and CVE-2026-39813, after patches were released in April, with researchers observing active exploitation across several countries.

People

Chris DoyleJupiterOne head of security and compliance who described the potential security impact of a FortiSandbox compromise.Simo KohonenDefused founder and CEO who described the firm's observations of exploitation events and activity attributed to sources in multiple countries.

Vendors

FortinetAttackers are exploiting multiple Fortinet FortiSandbox flaws, including CVE-2026-39808 and CVE-2026-39813, after patches were released in April, with researchers observing active exploitation across several countries.

Products

FortiSandboxAttackers are exploiting multiple Fortinet FortiSandbox flaws, including CVE-2026-39808 and CVE-2026-39813, after patches were released in April, with researchers observing active exploitation across several countries.

Countries

BulgariaDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.CanadaDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.ChinaDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.GermanyDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.IndiaDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.SingaporeDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.South KoreaDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.TaiwanDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.the NetherlandsDefused traced the malicious activity to 13 sources originating from nine countries, including China, South Korea, Taiwan, India, Singapore, Germany, the Netherlands, Canada and Bulgaria.

Related Articles