Unattributed (no public campaign; exploitation flagged by CISA)critical
The box built to run malware, run by whoever knocks: two RCEs in FortiSandbox
FortiSandbox is the box where suspicious files are detonated safely. Two unauthenticated OS command injection flaws — one in the WEB UI, one in an API endpoint — let anyone execute commands on the appliance itself. Patched quietly in April and June under a "Known Exploited: No" label, both were added to the CISA KEV catalog on 16 July: a sign someone had started using them, with the patch already months old.
The paradox at the center of the device
A network sandbox like FortiSandbox exists for one precise reason: to be the place where dangerous things can happen without doing harm. FortiGate, FortiMail and the other Security Fabric components hand it suspicious files and URLs; it detonates them inside isolated virtual machines, watches what they do, and returns a verdict. It is, by design, the blast chamber where the fuse gets lit.
On 16 July 2026, CISA added two FortiSandbox flaws to its catalog of known exploited vulnerabilities. Neither one is about the blast chamber. They are about the front door: both let an unauthenticated attacker execute system commands on the appliance itself, with a single crafted HTTP request. The box built to run other people's code safely can be made to run code for anyone who knocks.
- 14 April 2026
FG-IR-26-100Fortinet publishes CVE-2026-39808: OS command injection on an API endpoint.
- 9 June 2026
FG-IR-26-141Fortinet publishes CVE-2026-25089: injection in the WEB UI, "start vnc" feature.
- 16 July 2026
exploitationCISA adds both CVEs to the KEV catalog.
- 19 July 2026Due date
CISA's remediation deadline for federal agencies.
Two doors, one room
The two vulnerabilities are variants of the same defect — CWE-78, improper neutralization of special elements used in an OS command — on two different surfaces.
CVE-2026-39808 (FG-IR-26-100), published on 14 April and reported by Samuel de Lucas Maroto of KPMG Spain, lives in an API endpoint: a crafted HTTP request leads to command execution. It affects FortiSandbox 4.4.0–4.4.8; the 5.0 branch is not affected.
CVE-2026-25089 (FG-IR-26-141), published on 9 June and found internally by Fortinet, is the sneakier one: a second-order injection through a JSON input to the "start vnc" feature in the WEB UI. "Second-order" means the hostile value is not executed when it arrives, but later, when the application reuses it in a context where it becomes a command. It covers more products: FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, plus FortiSandbox Cloud and PaaS 5.0.4–5.0.5.
In both cases the attacker needs no credentials. That is what makes these flaws top priority: no login, no token, no user — only the ability to reach the management interface or the API over the network.
- 01HTTP requestthe attacker reaches the WEB UI or API endpoint, unauthenticated
- 02Unneutralized input"start vnc" JSON (25089) or an API parameter (39808)
- 03OS command injectionspecial characters land inside a system command
- 04Execution on the appliancethe code runs on the sandbox, not in the isolated VM
Why a sandbox is a worse target than a firewall
A detonation appliance is not just another box to compromise. To do its job it receives, from the rest of the Security Fabric, the files and URLs no one else is willing to open: email attachments, downloaded samples, flagged payloads. It sits in a trusted position and sees material that, by definition, is already suspect.
Whoever gets command execution on that device inherits that position. They can read queued samples and verdicts already issued; they can, in principle, manipulate the verdicts — teach the sandbox to say "clean" about what is not, turning the defensive tool into a pass; they can use it as a beachhead toward the Fabric components that trust it. This is not a plain RCE on a perimeter box: it is an RCE on the device the others delegate the judgment of what is dangerous to.
What we do not know — and should say
Several things, and it is right to state them.
The most important: at publication time, both Fortinet advisories read "Known Exploited: No". Fortinet discussed them as an internal discovery and a responsible disclosure, with no exploitation flagged. It is the KEV addition of 16 July that says otherwise: CISA adds a CVE to KEV only with evidence of active exploitation. The two sources do not contradict each other — they describe different moments — but there is, as of today, no public vendor or researcher report describing the campaign, the actor, or the indicators. We know someone is using them; we do not know who, how, or against whom.
Second uncertainty: the score. NVD marks both CVEs as Awaiting Enrichment and has not yet assigned its own base score; the only one present is the CNA's (Fortinet). And the two Fortinet values do not match — 9.8 in the CNA record on NVD, 9.1 in the metric at the top of the advisory. We have reported both.
Third: the technical mechanism. There is no public exploit and no detailed analysis; the description above follows the advisory titles and summaries (second-order injection via JSON in "start vnc"; injection on an API endpoint) and does not go into operational detail you do not need in order to defend yourself.
Finally, the ATT&CK IDs at the top of this dossier — T1190 and T1059 — do not come from the advisories, which do not list them: they are a reasoned mapping of what the flaws allow (reaching an exposed application and executing commands), not a value copied from a primary source.
What to do, now
Remediation is clean-cut because the patch has existed for months. Upgrading FortiSandbox and FortiSandbox Cloud/PaaS to 4.4.9 or 5.0.6 and above closes both flaws. Anyone still on 4.4.0–4.4.8 is exposed to both; anyone on 5.0.0–5.0.5, to the WEB UI injection.
While waiting for the maintenance window, the highest-impact mitigation is the simplest: a sandbox's WEB UI and management API should not be reachable from the internet, nor exposed beyond the administration network. A device that receives input only from the other Fabric components has no reason to offer its interface to the world.
For retrospective hunting, absent public IOCs, the indicator is behavior: unexpected requests to the FortiSandbox interface or API from external sources, anomalous processes on the appliance, configuration changes or accounts appearing outside the expected workflows. The date that matters is 16 July, but the flaw had been waiting since 14 April: anyone who watched only the patch calendar, and not their own exposure, had a three-month window open without knowing it.
