Security vendor Fortinet reports three vulnerabilities in its FortiSandbox solution. According to external experts, these are being actively exploited.
Three for the price of one: Fortinet has identified three vulnerabilities in its FortiSandbox. FortiSandbox is a tool designed to detect potential threats, but it apparently remained blind to its own vulnerabilities. Fortinet has rolled out the necessary patches.
Specifically, these are vulnerabilities CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089. The danger lies primarily in the combination. Attackers can exploit the vulnerabilities to log in without authentication with elevated privileges and remotely execute malicious code without any victim interaction.
Patches available
As usual, Fortinet only makes the vulnerabilities public after rolling out a patch, which has been available since April 14. In Fortinet’s posts, you can read which versions of FortiSandbox are affected. With version 5.2, you are safe in any case. CVE-2026-25089 can also affect versions of FortiSandbox Cloud and FortiSandbox PaaS.
The security specialist has not shared any information regarding active exploitation of the vulnerabilities. However, DefusedCyber claims to have seen active exploitation in the last 24 hours since the public disclosure. Fortinet has not yet responded to that claim.
Not the first time
A software vulnerability can happen to even the best security vendor, although it occurs remarkably often at Fortinet. The company also rolled out urgent security updates for FortiSandbox last month, and it is not the only solution that has recently shown cracks.
Fortunately, Fortinet is consistent in rolling out patches, but users must actually install them. Outdated security software does the exact opposite of keeping your IT environment secure.