Fortinet Patches Critical FortiSandbox Vulnerabilities

Summary

Fortinet released 26 security advisories addressing 27 vulnerabilities across its product portfolio, including two critical-severity flaws in FortiSandbox. CVE-2026-39813 allows authentication bypass via the JRPC API, while CVE-2026-39808 enables OS command injection for arbitrary code execution; both have a CVSS score of 9.1 and can be exploited without authentication via crafted HTTP requests. The company also patched a high-severity buffer overflow in FortiAnalyzer Cloud and SQL injection bugs in FortiDDoS-F and FortiClientEMS, with no reported active exploitation in the wild.

Full text

Fortinet on Tuesday released 26 advisories detailing 27 vulnerabilities across its products, including two critical-severity flaws in FortiSandbox. Tracked as CVE-2026-39813, the first of the critical bugs impacts the FortiSandbox JRPC API and could allow attackers to bypass authentication. The second one, tracked as CVE-2026-39808, is an OS command injection issue that can be exploited for arbitrary code or command execution. Both security defects have a CVSS score of 9.1 and could be exploited without authentication via specially crafted HTTP requests. On Tuesday, Fortinet also patched CVE-2026-22828, a high-severity buffer overflow vulnerability in FortiAnalyzer Cloud that could be exploited without authentication for remote code execution or arbitrary command execution. “Successful exploitation would require a large amount of effort in preparation because of ASLR and network segmentation. Thanks to network segmentation, this vulnerability could only be exploited if the attacker has already access to another cloud component belonging to the same entity,” Fortinet says.Advertisement. Scroll to continue reading. The company also addressed two high-severity SQL injection bugs in FortiDDoS-F and FortiClientEMS that could be exploited via crafted requests to run arbitrary SQL queries on the database. Both flaws require authentication. The remaining security defects patched by Fortinet on Tuesday are medium- and low-severity issues leading to service discovery, XSS attacks, code execution, information disclosure, path traversal attacks, file write and deletion, user redirects, configuration tampering, denial-of-service (DoS) attacks, database dump decryption, credential leaks, authentication bypass, and arbitrary directory deletion. Fortinet makes no mention of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s PSIRT advisories page. Related: ICS Patch Tuesday: 8 Industrial Giants Publish New Security Advisories Related: Microsoft Patches Exploited SharePoint Zero-Day and 160 Other Vulnerabilities Related: Adobe Patches 55 Vulnerabilities Across 11 Products Related: SAP Patches Critical ABAP Vulnerability Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Organizations Warned of Exploited Windows, Adobe Acrobat VulnerabilitiesFake Claude Website Distributes PlugX RATGmail Brings End-to-End Encryption to Android and iOS for Enterprise UsersJuniper Networks Patches Dozens of Junos OS VulnerabilitiesOrthanc DICOM Vulnerabilities Lead to Crashes, RCEMITRE Releases Fight Fraud FrameworkCritical Marimo Flaw Exploited Hours After Public DisclosureGoogle Rolls Out Cookie Theft Protections in Chrome Latest News ICS Patch Tuesday: 8 Industrial Giants Publish New Security AdvisoriesMicrosoft Patches Exploited SharePoint Zero-Day and 160 Other VulnerabilitiesAdobe Patches 55 Vulnerabilities Across 11 Products‘Mythos-Ready’ Security: CSA Urges CISOs to Prepare for Accelerated AI ThreatsEurope’s Largest Gym Chain Says Data Breach Impacts 1 Million MembersSAP Patches Critical ABAP VulnerabilityTriad Nexus Evades Sanctions to Fuel CybercrimeGoogle Adds Rust DNS Parser to Pixel Phones for Better Security Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveThe United States Department of War appointed David Vaughn as Technical Advisor for Data Infrastructure.Black Duck has named Dom Glavach as Chief Information Security Officer.Finite State has named Ann Miller as Vice President of Marketing.More People On The MoveExpert Insights The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle with Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-39813
• cve — CVE-2026-39808
• cve — CVE-2026-22828

Entities