Threat actors have begun actively exploiting multiple critical Fortinet FortiSandbox vulnerabilities within the past 24 hours, including CVE-2026-39813 a flaw with no previously recorded in-the-wild exploitation.
Security researchers observing honeypot activity have detected exploitation attempts originating from IP address 141.11.43.175, attributed to ASN AS136510, targeting decoy FortiSandbox infrastructure over port 443 via crafted JSONRPC POST requests.
Critical Fortinet FortiSandbox Vulnerabilities
Three CVEs are being leveraged in this active exploitation cluster. CVE-2026-39813 (CVSS 9.8 Critical) is a path traversal (../filedir) vulnerability in FortiSandbox’s JRPC API, affecting versions 5.0.0–5.0.5 and 4.4.0–4.4.8.
The Flaw allows unauthenticated privilege escalation and authentication bypass via specially crafted HTTP requests.
CVE-2026-39808 (CVSS 9.8 Critical) is an OS command injection flaw exploitable through the jid GET parameter, enabling unauthenticated attackers to execute arbitrary commands as root on affected systems.
A public proof-of-concept and Nuclei detection template for this CVE have been available since April 2026.
CVE-2026-25089, described internally as a “vibecoded” exploit likely AI-generated or hastily assembled, has no confirmed, reliable public exploit, and exploitation attempts involving this CVE are assessed as potentially faulty with inconsistent code execution results.
The observed attack chain uses standard browser User-Agent spoofing (Chrome 149 on Windows NT 10.0 x64) to blend HTTP exploitation traffic with legitimate-looking web requests.
The attacker’s infrastructure is flagged with a 1.6 “High Interest” threat score and originates from a Singapore-based hosting provider known to be leveraged in automated scanning campaigns.
Both CVE-2026-39813 and CVE-2026-39808 require no authentication, no prior access, and no user interaction making them trivially weaponizable against any exposed FortiSandbox management interface.
Affected Versions & Patches
Fortinet released patches for these vulnerabilities in April 2026. The table below outlines the affected version ranges and recommended fixes.
Organizations running FortiSandbox should upgrade to version 4.4.9 or 5.0.6 immediately and ensure the management interface is not exposed to the public internet.
Security teams should monitor logs for anomalous JSONRPC POST requests to /jsonrpc/ endpoints from unexpected source IPs, and should threat hunt for lateral movement originating from FortiSandbox hosts.
Blocking ASN AS136510 and associated IP ranges is also advised where no legitimate business need exists.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
