CISA Orders Patch of Actively Exploited Critical FortiSandbox OS Command Injection Flaws (CVE-2026-39808, CVE-2026-25089, CVE-2026-39813) — Threadlinqs Intelligence
As of 2026-07-17, CISA Orders Patch of Actively Exploited Critical FortiSandbox OS Command Injection Flaws (CVE-2026-39808, CVE-2026-25089, CVE-2026-39813) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-1447 · Severity: CRITICAL · CVSS: 9.1 · Status: ACTIVE · Category: VULNERABILITY
CISA added two critical unauthenticated OS command injection vulnerabilities in Fortinet FortiSandbox (CVE-2026-39808, CVE-2026-25089, both CVSS 9.1) to its Known Exploited Vulnerabilities catalog on
FortiSandbox is Fortinet's malware-analysis and sandboxing appliance that other Fortinet security products (FortiGate, FortiMail, FortiWeb, etc.) rely on for threat verdicts to enforce blocking decisions and trigger automated response. Three vulnerabilities affecting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS have been chained by attackers in the wild.
CVE-2026-39808 (FG-IR-26-112, disclosed April 14, 2026) is an OS command injection vulnerability (CWE-78) in the FortiSandbox API affecting versions 4.4.0-4.4.8. A publicly available PoC targets the `/fortisandbox/job-detail/tracer-behavior` endpoint, injecting shell metacharacters (pipe operators) into the `jid` (job ID) URL parameter, e.g. decoded payload `|(echo canary > /web/ng/proof.php)|`. Because the parameter is passed unsanitized into a shell command executed by a backend service running as root, a single unauthenticated HTTP GET request achieves remote code execution with full root privileges — no login, no user interaction, low attack complexity.
CVE-2026-39813 (FG-IR-26-112, disclosed April 14, 2026, CVSS 9.1) is a path traversal vulnerability in the FortiSandbox JRPC API's session-validation logic. The `is_valid_session()` function passes a user-supplied `session` value directly into Python's `os.path.join()` without sanitization; supplying a value such as `../../tmp/` causes the check to validate against `/tmp/`, a directory that always exists and whose modification time is continuously refreshed by normal system activity — bypassing authentication entirely. Exploitation grants read-only access to system information: firmware/audit data, system version, hostname, serial number, CPU/RAM/disk utilization, and scan configuration, which attackers use for reconnaissance ahead of further exploitation. Affects FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5.
CVE-2026-25089 (FG-IR-26-141, disclosed June 9, 2026, discovered internally by Adham El Karn of the Fortinet Product Security team) is a second-order OS command injection vulnerability in the FortiSandbox web GUI's 'start vnc' feature, triggered via crafted JSON input in specially crafted HTTP requests. It affects FortiSandbox 5.0.0-5.0.5, FortiSandbox 4.4.0-4.4.8, FortiSandbox Cloud 5.0.4-5.0.5, and FortiSandbox PaaS 5.0.4-5.0.5. CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) — the E:F (exploit code functional) modifier and RC:C (report confidence confirmed) reflect Fortinet's own acknowledgment of functional public exploitation, though outside researchers describe the observed CVE-2026-25089 exploit attempts as 'vibecoded' (AI-generated, low quality) and largely non-functional.
Threat intelligence firm Defused first reported active in-the-wild abuse of all three CVEs on/around June 16, 2026. Fortinet has not publicly confirmed exploitation and has not released IOCs beyond what independent researchers have derived from PoC and honeypot analysis. CISA added CVE-2026-39808 and CVE-2026-25089 to the KEV catalog on July 16, 2026 with a July 19, 2026 remediation deadline for federal civilian agencies under BOD 26-04. Remediation is to upgrade to FortiSandbox 4.4.9+ or 5.0.6+ (Cloud/PaaS to 5.0.6+) and restrict management/API interface exposure to trusted networks. FortiSandbox is a particularly high-value target because compromise exposes previously-submitted malware samples and can be used to falsify threat verdicts fed to connected FortiGate/FortiMail/FortiWeb enforcement points, plus provides a pivot point into the internal network segments FortiSandbox is deployed to inspect traffic from.
Weaknesses (CWE)
CWE-78, CWE-22, CWE-287
Target sectors: government administration, finance, health, technology, critical infrastructure, telecoms
Target regions: Global, North America
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-39808, CVE-2026-25089, CVE-2026-39813, T1595, T1190, T1059, T1059.004, T1211, T1212, T1082, T1046, T1083, T1005
