Watch out for more Fortinet vulns! Two critical bugs in Fortinet's sandbox could allow unauthenticated attackers to bypass authentication or execute unauthorized code on vulnerable systems. Luckily, the security vendor has issued fixes - so patch now - and so far, there are no reports of active exploitation. But considering that the vulnerabilities are now public, both can be exploited without any authentication, and that attackers do love abusing Fortinet products, that is likely to change soon. CVE-2026-39808 is an OS command injection flaw in FortiSandbox that allows unauthenticated attackers to execute unauthorized code or commands via HTTP requests. It received a critical, 9.1 CVSS rating, and it affects versions 4.4.0 through 4.4.8. Upgrading to FortiSandbox 4.4.9 or above patches the hole. The second flaw, CVE-2026-39813, is a path traversal bug in the FortiSandbox JRPC API that allows an authentication bypass using specially crafted HTTP requests. It also earned a 9.1 CVSS rating and affects FortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5. Patch to 4.4.9+ or 5.0.6+, depending on the branch, to fix the flaw. Fortinet security analyst Loic Pantano found this one. A security researcher named Rishi has published scanners for both (CVE-2026-39808 and CVE-2026-39813), so we'd suggest using these to check and see if you are running any vulnerable instances. These security updates arrive about a week after Fortinet released an emergency patch for CVE-2026-35616, a cr...
Patch these critical Fortinet sandbox bugs that let attackers bypass login, run commands over HTTP
The Register
·Jessica Lyons
·Published Apr 15, 2026
·Updated
Affected Software
2 affected components
Fortinet FortiSandbox>=4.4.0<=4.4.8
Fortinet FortiSandbox>=4.4.0<=4.4.8, >=5.0.0<=5.0.5
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses critical vulnerabilities in Fortinet's FortiSandbox that could allow unauthenticated attackers to bypass authentication and execute unauthorized commands.
2
What security implications are discussed?
The vulnerabilities could lead to unauthorized access and command execution on affected systems, posing significant security risks.
3
What products or software are affected?
The affected product is Fortinet's FortiSandbox, specifically versions between 4.4.0 and 4.4.8, as well as 5.0.0 to 5.0.5.
4
What actions should users take in response to these vulnerabilities?
Users should apply security patches provided by Fortinet to mitigate the risks associated with these vulnerabilities.
5
Who is likely to be targeted by these vulnerabilities?
Unauthenticated attackers are the primary threat, as the vulnerabilities allow them to exploit the FortiSandbox without needing credentials.