Fortinet Patches Critical FortiSandbox Vulnerabilities

Fortinet on Tuesday released 26 advisories detailing 27 vulnerabilities across its products, including two critical-severity flaws in FortiSandbox.

Tracked as CVE-2026-39813, the first of the critical bugs impacts the FortiSandbox JRPC API and could allow attackers to bypass authentication.

The second one, tracked as CVE-2026-39808, is an OS command injection issue that can be exploited for arbitrary code or command execution.

Both security defects have a CVSS score of 9.1 and could be exploited without authentication via specially crafted HTTP requests.

On Tuesday, Fortinet also patched CVE-2026-22828, a high-severity buffer overflow vulnerability in FortiAnalyzer Cloud that could be exploited without authentication for remote code execution or arbitrary command execution.

“Successful exploitation would require a large amount of effort in preparation because of ASLR and network segmentation. Thanks to network segmentation, this vulnerability could only be exploited if the attacker has already access to another cloud component belonging to the same entity,” Fortinet says.

Advertisement. Scroll to continue reading.

The company also addressed two high-severity SQL injection bugs in FortiDDoS-F and FortiClientEMS that could be exploited via crafted requests to run arbitrary SQL queries on the database. Both flaws require authentication.

The remaining security defects patched by Fortinet on Tuesday are medium- and low-severity issues leading to service discovery, XSS attacks, code execution, information disclosure, path traversal attacks, file write and deletion, user redirects, configuration tampering, denial-of-service (DoS) attacks, database dump decryption, credential leaks, authentication bypass, and arbitrary directory deletion.

Fortinet makes no mention of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s PSIRT advisories page.

Originally published by SecurityWeek

Full Analysis