Critical Fortinet FortiSandbox Vulnerabilities Exploited in the Wild

Multiple critical FortiSandbox vulnerabilities (notably CVE-2026-39813 and CVE-2026-39808, both CVSS 9.8) are being actively exploited in the wild; attackers are sending crafted JSONRPC POST requests to /jsonrpc/ from IP 141.11.43.175 (ASN AS136510) and using unauthenticated paths to achieve privilege escalation or root command execution. Fortinet issued patches in April 2026; organizations are advised to immediately upgrade affected FortiSandbox versions to 4.4.9 or 5.0.6, block the hostile ASN where appropriate, and monitor for anomalous /jsonrpc/ traffic and lateral movement originating from sandbox hosts.