Critical Fortinet FortiSandbox Vulnerabilities Actively Exploited in Attacks

Threat actors are actively exploiting multiple critical vulnerabilities in Fortinet’s FortiSandbox platform, with live attack telemetry confirming exploitation attempts over the past 24 hours.

Defused has flagged three CVEs under active targeting — including one, CVE-2026-39813, with no previously recorded exploitation history.

Honeypot sensors and deception infrastructure disguised as Fortinet FortiSandbox instances have captured exploitation attempts across three vulnerabilities, all triggered over port 443 via crafted POST requests to the /jsonrpc/ API endpoint.

CVE-2026-39813 : A path traversal vulnerability (CWE-24) in the FortiSandbox JRPC API that allows an unauthenticated remote attacker to bypass authentication via specially crafted HTTP requests.

By injecting traversal sequences such as session: "../../tmp/" into the API, attackers can access sensitive system data — including configuration backups, serial numbers, and version details — without any credentials. This CVE has no prior recorded exploitation in the wild, making this cluster of observed attacks a first-of-its-kind event.

CVE-2026-39808: An OS command injection flaw (CWE-78) in a FortiSandbox API endpoint that allows unauthenticated attackers to execute arbitrary commands as root.

A public proof-of-concept exploit has been available since April 2026, weaponizing the jid GET parameter via pipe-chained Unix commands. Attack payloads consistent with this PoC have now been observed in live exploitation attempts.

CVE-2026-25089 : A second OS command injection vulnerability (CWE-78) affecting the FortiSandbox Web UI across versions 5.0.0–5.0.5, 4.4.0–4.4.8, 4.2 all versions, and FortiSandbox Cloud/PaaS deployments. Notably, no functional public exploit has been disclosed for this CVE.

Observed exploitation attempts appear to be “vibecoded” — i.e., likely AI-assisted or heuristically generated exploits with faulty logic — suggesting opportunistic actors are probing without a validated working payload.

Affected Versions

All three CVEs can be triggered without authentication through a single HTTP request, meaning exposed FortiSandbox management interfaces require zero pre-existing access to exploit.

A compromised FortiSandbox can be weaponized to approve malicious files as clean to dependent Fortinet products or serve as a lateral movement pivot within enterprise networks.

The attacker’s IP was observed in active exploitation 141.11.43[.]175 is attributed to AS136510 Streamline Servers Pty Ltd (Singapore) and carries a high-interest threat score.

Indicators of Compromise (IOCs)

Follow us on Google News, LinkedIn, and X to Get More Instant Updates.