Critical Fortinet FortiSandbox Vulnerabilities Actively Exploited in Attacks

**Executive Summary:** Threat actors are actively exploiting multiple critical, unauthenticated vulnerabilities in FortiSandbox (including a newly observed path traversal CVE-2026-39813 and command injection CVE-2026-39808) via crafted POST requests to /jsonrpc/, with live telemetry and IOCs (attacker IP 141.11.43.175, ASN AS136510, target port 443, user-agent) confirming ongoing attacks that can enable root execution, lateral movement, and approval of malicious files in dependent Fortinet systems.