Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week

Threat intelligence firm Defused Cyber observed exploitation of multiple high-severity FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) over a 24-hour period; the flaws (CVSS 9.1) enable unauthenticated path traversal and OS command injection, Fortinet has issued patches (April 2026 and last week), and one observed exploit shows signs of being AI-developed though a working public exploit has not been disclosed.