cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

FortiSandbox Flaws Reportedly Exploited as Fortinet Releases Patches

· Original article ↗

Summary

Defused reports exploitation of three critical FortiSandbox flaws that can enable unauthenticated privilege escalation and remote code execution. Fortinet released patches; the company had not confirmed the reports to BleepingComputer.

Key points

  • Defused reports recent exploitation of CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 in FortiSandbox.
  • The flaws reportedly allow unauthenticated attackers to escalate privileges and execute code remotely through low-complexity command injection without user interaction.
  • Defused said a working exploit for CVE-2026-25089 had not been publicly disclosed and described the observed exploit as likely faulty.
  • Fortinet released security updates for the three flaws on April 14; administrators are advised to upgrade affected deployments.
  • BleepingComputer said Fortinet had not responded to its request to confirm active exploitation.

Article Details

Vulnerability Types
  • Command injection
  • Path traversal
  • SQL injection
Severity
Critical for CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089; medium for CVE-2025-61624.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Upgrade affected FortiSandbox deployments to the latest released versions.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe reported FortiSandbox vulnerabilities can be exploited to escalate privileges.

CVE

CVE-2025-61624Fortinet · FortiOS; Fortinet · FortiPAM; +3 more#FortinetCVE-2026-21643Fortinet · FortiClientEMS#FortinetCVE-2026-25089Fortinet · FortiSandbox; Fortinet · FortiSandbox Cloud; +1 morecritical Fortinet FortiSandbox vulnerabilities, including CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, which can enable privilege escalation and remote code execution without user interaction.CVE-2026-26083Fortinet · Fortisandbox; Fortinet · Fortisandbox cloud; +1 more#FortinetCVE-2026-39808Fortinet · FortiSandbox; Fortinet · FortiSandbox PaaSexploiting multiple critical Fortinet FortiSandbox vulnerabilities, including CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, which can enable privilege escalation and remote code execution without userCVE-2026-39813Fortinet · FortiSandbox; Fortinet · FortiSandbox CloudAttackers are actively exploiting multiple critical Fortinet FortiSandbox vulnerabilities, including CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, which can enable privilege escalation and remote code execution

Vendors

FortinetAttackers are actively exploiting multiple critical Fortinet FortiSandbox vulnerabilities, including CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, which can enable privilege escalation and remote code execution

Products

FortiClient EMSIn February, it also patched a critical SQL injection vulnerability (CVE-2026-21643) in the FortiClient Enterprise Management Server (EMS) platform, which Defused flagged as actively exploited one month later.FortiSandboxAttackers are actively exploiting multiple critical Fortinet FortiSandbox vulnerabilities, including CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, which can enable privilege escalation and remote code execution

Countries

United StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies on April 13 to secure their FortiClient EMS instances against attacks targeting the CVE-2026-21643 flaw within three days.

Related Articles