Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week

Fortinet FortiSandbox is under active exploitation for three critical unauthenticated RCE vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089). All three bypass authentication and allow arbitrary command execution via HTTP requests. Organizations running FortiSandbox are at immediate risk of compromise regardless of patch status.