Hackers Exploit Three Patched FortiSandbox Flaws

Cybersecurity researchers have confirmed that attackers are actively exploiting three critical vulnerabilities in Fortinet's FortiSandbox threat detection platform, with some exploits appearing to be generated by artificial intelligence. The exploitation attempts have been observed over a concentrated period, highlighting the shrinking window between the release of patches and their active weaponization.

The vulnerabilities, tracked as CVE-2026-39813 and CVE-2026-39808, were both patched by Fortinet in April. The first allows an unauthenticated attacker to bypass authentication, while the second is an operating system command injection flaw enabling remote code execution. The third flaw, CVE-2026-25089, was patched just last week but is already being targeted. It is also a command injection vulnerability affecting multiple FortiSandbox products, allowing unauthorized command execution.

According to the threat intelligence firm Defused, which first reported the activity, exploitation attempts for these flaws were observed in a 24-hour window. Researchers noted that the exploit code for CVE-2026-25089 shows signs of being developed with AI assistance and appears to be faulty, as a...