3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs

Three recently patched vulnerabilities in Fortinet FortiSandbox are actively targeted in the wild. Two of these vulnerabilities, CVE-2026-39808 and CVE-2026-39813, are rated critical and allow authentication bypass and OS command injection, respectively. A third vulnerability, CVE-2026-25089, patched in June 2026, permits remote unauthenticated command execution. Additionally, over 30,000 Fortinet firewalls have been compromised in a campaign dubbed FortiBleed, exposing networks globally and enabling attackers to harvest credentials for further intrusions. The threat actor uses automated scanning and credential stuffing to propagate access, with indications of targeting defense industry VPNs. Exploits have been observed since June 2026, including AI-generated attempts. Fortinet has issued patches for these vulnerabilities.

• securityweek.com/3-recently-patched-fortinet-fortisandbox-vulnerabilities-in-hacker-crosshairs/ (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1u834bl/3_recently_patched_fortinet_fortisandbox/ (opens in a new tab)

• CVE-2026-25089: Fortinet FortiSandbox · Execute Unauthorized Code or CommandsCriticalVulnerability2026-06-09
• CVE-2026-39813: Fortinet FortiSandbox · Escalation of PrivilegeCriticalVulnerability2026-04-14
• CVE-2026-39808: Fortinet FortiSandbox · Execute Unauthorized Code or CommandsCriticalVulnerability2026-04-14
• PHP2Shell was probed 4 days before disclosure. Is anyone doing a look-back hunt, not just patching?News2026-10-22
• PHP2Shell: patching priorities, exposure checks, and the limits of virtual patchingNews2026-10-22