Vulnerabilities & Exploits · Web App Attack

FortiSandbox Bugs Let Attackers Skip Login and Run Commands

FortiSandbox is exposed to full takeover if it is reachable from the internet. The standard response is to treat this as a patch-only issue, but unauthenticated auth bypass and OS command injection mean an attacker may not need credentials at all.

Fortinet patched CVE-2026-39813, a critical authentication bypass in the FortiSandbox JRPC API, and CVE-2026-39808, a critical OS command injection flaw. Both score 9.1 and can be triggered through crafted HTTP requests without authentication. Fortinet also fixed CVE-2026-22828 in FortiAnalyzer Cloud, a high-severity buffer overflow that can be reached without authentication, though Fortinet says exploitation would be difficult and would require access to another cloud component in the same entity.

The risk persists anywhere these products are exposed to untrusted networks. In FortiSandbox, the issue is not just access to the appliance but control of the sandbox itself, which can turn a security control into an entry point.

3 sources · Apr 16

Timeline

• Jul 19 CISA federal deadline for CVE-2026-39808
• Jul 16 CVE-2026-39808 added to CISA KEV
• Apr 16 Reported by Help Net Security
• Apr 15 Reported by The Register Security

Sources

• Apr 16 Help Net Security

  Fortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808) - Help Net Security

  Two vulnerabilities (CVE-2026-39813, CVE-2026-39808) in FortiSandbox could be exploited by unauthenticated attackers via HTTP requests.

  original

• Apr 15 The Register Security

  Critical Fortinet sandbox bugs allow auth bypass and RCE

  : No reports of active exploitation (yet)

  original

• Apr 15 SecurityWeek

  Fortinet Patches Critical FortiSandbox Vulnerabilities

  The flaws could allow attackers to bypass authentication or execute arbitrary code or commands via HTTP requests.

  original

Vendor digest: Fortinet

Part of the PlainSec briefing for 2026-04-16

Every edition of this story: FortiSandbox Bugs Let Attackers Skip Login and Run Commands

More from today

• Nginx UI’s MCP Endpoint Opens Full Server Takeover
• Windows Task Host Flaw Gives Local Users SYSTEM
• Old Excel RCE Returns to CISA’s Exploited List