VulnerabilitycriticalExploited in the wild

Fortinet Warned as Three Critical FortiSandbox Bugs Come Under Attack

Security Affairsby @securityaffairsJun 16, 2026 · 14:26 UTC (Jun 16, 2026)2 min read2 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-39813 CVE-2026-39808 CVE-2026-25089 CVE-2026-35616

Tags: cve-2026-25089 cve-2026-35616 cve-2026-39808 cve-2026-39813 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-25089	Unauthenticated OS Command Injection RCE in Fortinet FortiSandbox	9.8	76%	KEV	Jun 9, 2026 KEV Jul 16, 2026
CVE-2026-35616	Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6	9.8	94%	KEVPoC	Apr 4, 2026 KEV Apr 6, 2026
CVE-2026-39808 +1 related CVE CVE-2026-39813	Unauthenticated OS Command Injection in Fortinet FortiSandbox 4.4	9.8	93%	KEVPoC ×3	Apr 14, 2026 KEV Jul 16, 2026

From the original article

2 min read at securityaffairs.com

Three FortiSandbox flaws, including one patched last week, are being actively exploited, highlighting the shrinking window for defenders. Cybersecurity firm Defused Cyber confirmed it’s seen active exploitation of three vulnerabilities in Fortinet FortiSandbox within a 24-hour window. Two of them had patches sitting available since April.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.