Attackers Exploit Three Fortinet Forti Sandbox Flaws, One Patched Last Week

Summary: Defused Cyber reported observing exploitation of three FortiSandbox vulnerabilities - CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, each with a CVSS score of 9.1 - over a 24-hour period. The first two were patched by Fortinet in April 2026, while CVE-2026-25089 was fixed last week, and Defused Cyber noted the exploit for that flaw shows signs of AI-assisted development and is faulty, with no working public exploit disclosed.
What you should know: Separately, SOCRadar reported suspected Russian-speaking actors holding verified working credentials for more than 30,791 Fortinet devices across 194 countries, and Hudson Rock put the FortiBleed campaign at 73,932 unique firewall URLs and 21,632 affected domains - access that Fortinet attributes to prior incidents and brute-forcing rather than a new flaw.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-25089 CVE-2026-35616 CVE-2026-39808 CVE-2026-39813
Related: CISA Adds Exploited Share Point RCE Zero-Day CVE-2026-58644 to KEV Cyber Risks ·
⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More Cyber Risks ·
CVE-2026-39808: Fortinet Forti Sandbox OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jul 16, 2026