Three Patched FortiSandbox Flaws Targeted; SOCRadar Reports 30,000+ Compromised Fortinet Firewalls
Summary
Defused reports in-the-wild targeting of three patched FortiSandbox flaws. Separately, SOCRadar says the FortiBleed campaign compromised more than 30,000 Fortinet firewalls to collect credentials; the actor is unattributed.
Key points
- Defused says its honeypots recorded attempts against FortiSandbox CVE-2026-39808, CVE-2026-39813 and CVE-2026-25089.
- CVE-2026-39813 allows authentication bypass; CVE-2026-39808 is an OS command injection flaw. Both were rated critical and patched in April.
- Fortinet patched CVE-2026-25089 in June 2026. Defused said the exploit appeared AI-created and initially did not work.
- KEVIntel independently observed exploitation of CVE-2026-39808 on June 12; Defused and KEVIntel reported attacks targeting CVE-2026-39813 on June 15.
- Defused also reported exploitation attempts against FortiClient EMS vulnerabilities CVE-2026-21643 and CVE-2026-35616.
- SOCRadar says the FortiBleed campaign compromised more than 30,000 Fortinet firewalls and VPN gateways, using known passwords to gain access and collect credentials. The actor remains unattributed.
- SOCRadar said researchers recovered infrastructure and target data from an exposed server; Hudson Rock said the campaign appeared to affect major companies including Foxconn, Samsung and Oracle.
Article Details
- Event Type
- Reported in-the-wild exploitation of recently patched Fortinet vulnerabilities and a separate campaign compromising Fortinet firewalls and VPN gateways, dubbed FortiBleed.
- Impact
- Defused reported attempts to exploit three FortiSandbox vulnerabilities, and recent exploitation of two FortiClient EMS vulnerabilities. Separately, SOCRadar detected more than 30,000 compromised Fortinet firewalls across over 190 countries. The compromised devices exposed corporate networks and were reportedly used to monitor traffic and collect credentials; recovered data included credentials for what appeared to be a defense-industry VPN endpoint.
MITRE ATT&CK
CVE
CVE-2026-21643Fortinet · FortiClientEMSDefused recently also saw exploitation of two Fortinet FortiClient EMS vulnerabilities tracked as CVE-2026-21643 and CVE-2026-35616.CVE-2026-25089Fortinet · FortiSandbox; Fortinet · FortiSandbox Cloud; +1 moreDefused’s honeypots have been seeing attempts to exploit CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089.CVE-2026-35616Fortinet · FortiClientEMSDefused recently also saw exploitation of two Fortinet FortiClient EMS vulnerabilities tracked as CVE-2026-21643 and CVE-2026-35616.CVE-2026-39808Fortinet · FortiSandbox; Fortinet · FortiSandbox PaaSDefused’s honeypots have been seeing attempts to exploit CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089.CVE-2026-39813Fortinet · FortiSandbox; Fortinet · FortiSandbox CloudDefused’s honeypots have been seeing attempts to exploit CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089.
People
Vendors
Products
FortiClient EMSDefused recently also saw exploitation of two Fortinet FortiClient EMS vulnerabilities tracked as CVE-2026-21643 and CVE-2026-35616.FortiSandboxThree recently patched Fortinet FortiSandbox vulnerabilities are being targeted in the wild, according to exploit intelligence company Defused.