Fortinet FortiSandbox Triple-Flaw — Active Exploitation

Three critical (CVSS 9.1) vulnerabilities in Fortinet FortiSandbox are under active exploitation. Threat-intel firm Defused observed in-the-wild exploitation across all three within a 24-hour window (reported 2026-06-16). The attacker objective is unauthenticated remote code execution on the FortiSandbox appliance itself — a deep-trust security device that, once compromised, gives an adversary a foothold inside the inspection path, access to submitted samples and verdicts, and a pivot point into the management network.

• CVE-2026-39813 — path traversal in the FortiSandbox JRPC API; lets an unauthenticated attacker bypass authentication. (Patched 2026-04-14.)
• CVE-2026-39808 — OS command injection; unauthenticated attackers execute unauthorized code/commands. (Patched 2026-04-14.)
• CVE-2026-25089 — OS command injection affecting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS Web UI via crafted HTTP requests. (Patched in the June 2026 Patch Tuesday.)

Typical chain: unauthenticated crafted HTTP requests to the appliance Web UI / JRPC API → auth bypass via path traversal (CVE-2026-39813) → OS command injection (CVE-2026-39808 / CVE-2026-25089) → command execution on the appliance.

The CVE-2026-25089 exploit observed in the wild shows signs of being AI-generated ("vibecoded") and is currently faulty — no reliable public working exploit exists yet for that specific CVE. The auth-bypass + command-injection pair patched in April (-39813 / -39808) is the higher-confidence active threat.

Telemetry reality: FortiSandbox is a network appliance with little-to-no host EDR coverage. Falcon will not see process/file activity on the appliance. Detection leans on network/proxy/firewall logs for crafted HTTP requests to the management interface, path-traversal URI patterns, and anomalous outbound connections FROM the appliance management IP. Adjacent-host Falcon telemetry only helps post-pivot.

Defender priority: Confirm FortiSandbox is patched to a fixed build, pull the management interface off any internet-facing path, and hunt now for inbound path-traversal / command-injection HTTP requests to the appliance AND for any new outbound connection originating from the FortiSandbox management IP — that egress is the single highest-fidelity signal of successful exploitation.

Web-hunter note: No vendor-published atomic IOCs (hashes, C2 domains, source IPs) were available at the time of writing. Public reporting describes the vector and chain but not endpoint URIs or payloads. IOC blocks below therefore use REPLACE_WITH_… placeholders for atomic indicators and lean on behavioral / URI-pattern detection. Re-hunt this pack when Fortinet PSIRT or Defused publishes concrete IOCs.

Hunt hypotheses (fidelity-ordered)

Attack chain

No vendor-published atomic IOCs at time of writing. The indicators below are behavioral / contextual; atomic values are placeholders to be filled when Fortinet PSIRT / Defused publish them.

Bottom line: The appliance itself is a telemetry blind spot for Falcon. Highest-value coverage comes from network logs surrounding the appliance (inbound HTTP, outbound egress) and from Falcon coverage of the managed hosts the appliance can reach.

FortiSandbox appliance

• Confirm running firmware build against Fortinet PSIRT FG-IR advisories; anything below the 2026-04-14 fix for -39813/-39808 or the June 2026 fix for -25089 is exposed.
• Review FortiSandbox admin/event logs for unexpected administrative actions, new admin sessions, or JRPC API calls from unrecognized sources. Forward these logs to the SIEM if not already.
• Check for unexpected scheduled jobs, modified inspection profiles, or new files/components on the appliance (via vendor-supported console only — do not run offensive tooling).

Perimeter / network devices

• NGFW / reverse proxy / WAF: search inbound HTTP to the appliance management IP for path-traversal and command-metacharacter patterns (see CQL Q2/Q3 logic — same patterns apply to FortiGate/WAF log search).
• Firewall egress: alert on any outbound session sourced from the FortiSandbox management IP to a destination outside its known update/feed endpoints.
• DNS: review resolver logs for lookups originating from the appliance IP to newly-seen or low-reputation domains.

FortiSandbox Cloud / PaaS

• Pull tenant access/audit logs for the FortiSandbox Cloud / PaaS Web UI; look for unauthenticated or anomalous request patterns (CVE-2026-25089).

FortiSandbox has no Falcon host agent, so Q1–Q3 target NGSIEM / third-party HTTP log repos (NGFW, WAF, reverse proxy) ingested into Falcon NGSIEM — field names there are vendor-dependent; adjust to your parser. Q4–Q7 use the native Falcon EDR data model on adjacent managed hosts. Set FORTISANDBOX_MGMT_IP to your appliance management address before running.

// HUNT: Inbound exploit pattern to FortiSandbox mgmt interface
// MITRE: T1190, T1059
// CONF: high | FP: low | COST: medium | REQUIRES: NGFW/WAF/proxy HTTP logs in NGSIEM
// FALSE POSITIVES: security scanners / authorized pentest sources hitting the appliance
// TUNING: exclude approved scanner source IPs; restrict to dest = appliance mgmt IP
dest_ip="FORTISANDBOX_MGMT_IP"
| url := lower(url)
| regex("(\\.\\./|%2e%2e%2f|%2e%2e/|\\.\\.%5c|%c0%ae|;|\\|\\||&&|\\$\\(|`)", field=url, strict=false)
| groupBy([src_ip, url, http_method], function=count(as=hits))
| sort(hits, order=desc)
| table([src_ip, http_method, url, hits], limit=200)

// HUNT: Path-traversal auth bypass against FortiSandbox JRPC API
// MITRE: T1190
// CONF: high | FP: low | COST: low | REQUIRES: NGFW/WAF/proxy HTTP logs in NGSIEM
// FALSE POSITIVES: vulnerability scanners; broken client building malformed paths
dest_ip="FORTISANDBOX_MGMT_IP"
| regex("(\\.\\./|\\.\\.\\\\|%2e%2e(%2f|%5c|/|\\\\)|%252e%252e)", field=url, strict=false)
| groupBy([src_ip, url], function=count(as=attempts))
| attempts >= 1
| sort(attempts, order=desc)
| table([src_ip, url, attempts], limit=200)

// HUNT: OS command-injection metacharacters to FortiSandbox
// MITRE: T1190, T1059
// CONF: high | FP: medium | COST: medium | REQUIRES: NGFW/WAF/proxy HTTP logs (incl. body) in NGSIEM
// FALSE POSITIVES: benign query strings containing & or ; ; legit API JSON
// TUNING: require a shell command token (curl|wget|bash|sh|nc|id|whoami) near the metacharacter
dest_ip="FORTISANDBOX_MGMT_IP"
| payload := lower(url + " " + http_request_body)
| regex("(;|\\|\\||&&|\\$\\(|`|%3b|%7c)\\s*(curl|wget|bash|/bin/sh|\\bsh\\b|nc |ncat|python|id;|whoami|cat /etc)", field=payload, strict=false)
| groupBy([src_ip, http_method, url], function=count(as=hits))
| sort(hits, order=desc)
| table([src_ip, http_method, url, hits], limit=200)

// HUNT: New outbound from FortiSandbox mgmt IP (post-exploit callback)
// MITRE: T1071, T1105
// CONF: high | FP: low | COST: medium | REQUIRES: firewall/proxy egress logs in NGSIEM
// FALSE POSITIVES: Fortinet update / FortiGuard feed endpoints
// TUNING: allow-list Fortinet update FQDNs/IPs; alert on everything else
src_ip="FORTISANDBOX_MGMT_IP"
| direction="outbound"
| !cidr(dest_ip, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"])
| dest_domain != *.fortinet.com and dest_domain != *.fortiguard.com
| groupBy([dest_ip, dest_domain, dest_port], function=count(as=sessions))
| sort(sessions, order=desc)
| table([dest_ip, dest_domain, dest_port, sessions], limit=200)

// HUNT: Falcon host sees inbound connection from FortiSandbox mgmt IP
// MITRE: T1021, T1105
// CONF: medium | FP: low | COST: low | REQUIRES: Falcon NetworkConnectIP4
// FALSE POSITIVES: known appliance-to-host service ports (log forwarding, sample submit)
// TUNING: exclude RemotePort values for sanctioned appliance services
#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4="FORTISANDBOX_MGMT_IP"
| RemotePort != 514 AND RemotePort != 443
| groupBy([ComputerName, aid, RemotePort, LocalPort], function=count(as=conns))
| sort(conns, order=desc)
| table([ComputerName, aid, RemoteAddressIP4, RemotePort, LocalPort, conns], limit=200)

// HUNT: Logon activity on managed hosts (pivot correlation)
// MITRE: T1021, T1133
// CONF: medium | FP: medium | COST: low | REQUIRES: Falcon UserLogon
// FALSE POSITIVES: routine service/admin logons
// TUNING: join to Q5 hits by ComputerName + time window; alert only on overlap
#event_simpleName=/^UserLogon$/
| in(LogonType, values=[3, 10])
| groupBy([ComputerName, UserName, LogonType], function=count(as=logons))
| sort(logons, order=desc)
| table([ComputerName, UserName, LogonType, logons], limit=200)

// HUNT: Ingress tool transfer / scripted exec on adjacent hosts
// MITRE: T1105, T1059
// CONF: medium | FP: medium | COST: medium | REQUIRES: Falcon ProcessRollup2
// FALSE POSITIVES: admin scripting, software deployment, patching jobs
// TUNING: scope to ComputerName set returned by Q5; exclude known deployment service accounts
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(curl|wget|certutil\s+-urlcache|bitsadmin|powershell.*-enc|Invoke-WebRequest)/i
| groupBy([ComputerName, FileName, CommandLine], function=count(as=execs))
| sort(execs, order=desc)
| table([ComputerName, FileName, CommandLine, execs], limit=200)

Custom IOAs run on Falcon-managed hosts. The appliance has no agent, so IOA value is limited to the pivot stage. Network-side detection (Q1–Q4) should be promoted to NGSIEM scheduled searches / Custom IOC entries instead.

Network detections Q1–Q4 → promote as NGSIEM Scheduled Searches with email alerts (see alert package). Atomic IOCs (source IPs, C2 domains, payload hashes) → Falcon IOC Management once published.

One-click copy blocks for import / deployment. Atomic indicators use REPLACE_WITH_… placeholders — no vendor IOCs are public yet; the high-value content here is behavioral.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_SOURCE_IP,detect,critical,2026-12-18,FortiSandbox exploit source,campaign:FortiSandbox-Triple-Flaw
domain,REPLACE_WITH_C2,detect,high,2026-12-18,FortiSandbox post-exploit C2,campaign:FortiSandbox-Triple-Flaw
sha256,REPLACE_WITH_SHA256,prevent,critical,2026-12-18,Tooling dropped on pivoted host,campaign:FortiSandbox-Triple-Flaw

[INBOUND] HTTP to FortiSandbox mgmt IP with path traversal:
  ../  ..\  %2e%2e%2f  %2e%2e%5c  %252e%252e   (CVE-2026-39813)
[INBOUND] HTTP param/body to mgmt IP with shell metachar + cmd token:
  (;|||&&|$(|`) near (curl|wget|bash|sh|nc|id|whoami)  (CVE-2026-39808 / -25089)
[OUTBOUND] new session sourced from FortiSandbox mgmt IP to any host
  outside Fortinet update/feed allow-list  == successful RCE (highest fidelity)
[PIVOT] Falcon host inbound conn from mgmt IP on non-service port

CVE-2026-39813  CVSS 9.1  Path traversal in JRPC API -> auth bypass   (patched 2026-04-14)
CVE-2026-39808  CVSS 9.1  OS command injection, unauthenticated         (patched 2026-04-14)
CVE-2026-25089  CVSS 9.1  OS command injection (FortiSandbox + Cloud +
                          PaaS Web UI) via crafted HTTP                  (patched June 2026 PT)
Note: CVE-2026-25089 public exploit is AI-generated / faulty; no reliable working PoC yet.
Related: CVE-2025-61624 (path traversal, requires high privs) flagged exploited - chaining candidate.

# FortiSandbox exposure checklist
1. Confirm firmware >= fixed build per Fortinet PSIRT FG-IR advisory for each CVE.
2. Verify mgmt interface is NOT internet-reachable (run external port scan from outside).
3. Restrict mgmt/JRPC API to a dedicated admin VLAN / allow-listed source set.
4. Confirm appliance HTTP + egress logs are forwarded to SIEM / NGSIEM.
5. Set FORTISANDBOX_MGMT_IP in all Q* queries; build the Fortinet update allow-list for Q4.

A · FortiGate / perimeter — block & restrict the appliance mgmt interface (FortiOS CLI)

# 1. Restrict the FortiSandbox mgmt interface to an admin allow-list (run on the gateway protecting it)
config firewall address
    edit "FSA-MGMT"
        set subnet REPLACE_WITH_FSA_MGMT_IP 255.255.255.255
    next
    edit "ADMIN-ALLOWLIST"
        set type ipmask
        set subnet REPLACE_WITH_ADMIN_CIDR 255.255.255.0
    next
end
# 2. Permit admin sources to the appliance, deny all other inbound to it
config firewall policy
    edit 0
        set name "permit-fsa-admin-only"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "ADMIN-ALLOWLIST"
        set dstaddr "FSA-MGMT"
        set action accept
        set service "HTTPS" "SSH"
        set logtraffic all
    next
    edit 0
        set name "deny-fsa-mgmt-other"
        set srcaddr "all"
        set dstaddr "FSA-MGMT"
        set action deny
        set logtraffic all
    next
end
# 3. Default-deny egress from the appliance except Fortinet update/feed endpoints
#    (build the FORTIGUARD-FEEDS address group from current Fortinet update FQDNs/IPs)

B · NGSIEM scheduled-alert wiring (pseudocode)

# Promote Q1, Q2, Q4 to scheduled searches with email alerting:
search:    <paste Q1 / Q2 / Q4 CQL>
schedule:  every 15 minutes, lookback 20 minutes
threshold: results >= 1
action:    email SOC distro; create case; tag campaign:FortiSandbox-Triple-Flaw
# Keep Q3, Q6, Q7 as investigate-only until correlated with Q5 / Q4 hits.

C · Appliance verification readout

# On the FortiSandbox console (vendor-supported commands only):
#  - confirm running firmware build and compare to the FG-IR fixed version
#  - review admin session history and JRPC API access for unknown sources
#  - confirm syslog/log-forwarding to SIEM is enabled and reaching the collector
# Do NOT run untrusted / offensive tooling against production appliances.

Validation: Coverage is contingent on the appliance's surrounding HTTP and egress logs reaching NGSIEM. The two GAP rows (on-appliance persistence and Cloud/PaaS) are inherent telemetry blind spots, not tuning issues — cover them via vendor console review, appliance rebuild on confirmed compromise, and provider audit logs. Re-run all validation gates (§11) after setting FORTISANDBOX_MGMT_IP and building the Fortinet update allow-list.