Three recently patched Fortinet FortiSandbox vulnerabilities are being targeted in the wild, according to exploit intelligence company Defused.
Defused’s honeypots have been seeing attempts to exploit CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089.
CVE-2026-39813 and CVE-2026-39808 were both rated ‘critical severity’ and patched in April. The former allows an attacker to bypass authentication, while the latter is an OS command injection flaw that can be exploited to execute arbitrary code or commands.
CVE-2026-25089 was patched by Fortinet with its June 2026 Patch Tuesday updates. It allows a remote, unauthenticated attacker to execute arbitrary commands on vulnerable appliances.
Exploitation of CVE-2026-39808 was independently observed by KEVIntel on June 12. Both Defused and KEVIntel reported seeing attacks targeting CVE-2026-39813 on June 15.
Defused noted that the exploit for CVE-2026-25089 appears to have been created using AI and did not work when first observed by the company.
Defused recently also saw exploitation of two Fortinet FortiClient EMS vulnerabilities tracked as CVE-2026-21643 and CVE-2026-35616.
Compromised Fortinet firewalls
Separately, SOCRadar has detected more than 30,000 compromised Fortinet firewalls that expose corporate networks to hacking. The campaign has been dubbed FortiBleed.
According to the security firm, a threat actor has been systematically hacking Fortinet firewalls and VPN gateways, compiling a database of verified credentials that can be used to access them.
The compromised systems belong to companies and government organizations across more than 190 countries. Many of the devices are located in India and the United States.
“The attackers scan the internet for Fortinet devices, try a curated list of known passwords against each one, and record every successful login,” SOCRadar explained. “Once a device is compromised, they use it as a listening post, monitoring traffic passing through and collecting any additional credentials that flow by. Those freshly collected passwords are then fed back into the scanner to compromise even more devices. The system feeds itself.”
The threat actor left its server exposed, enabling researchers to collect data on its infrastructure and targets.
“Among the recovered data were credentials for what appears to be a defense industry VPN endpoint, suggesting the group’s ambitions extend beyond purely financial targets,” SOCRadar noted.
While the company has yet to attribute the attack to a known threat actor, it believes the hackers are likely Russian speakers.
The FortiBleed activity was also analyzed by researcher Bob Diachenko and cybersecurity firm Hudson Rock. Hudson Rock said the campaign appears to impact major companies such as Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, and Oracle.
*updated to mention that Diachenko and Hudson Rock are also monitoring the FortiBleed campaign
Related: Fortinet, Ivanti Patch Critical Vulnerabilities
Related: Fortinet Patches High-Severity Vulnerabilities
Related: Fortinet Patches Exploited FortiCloud SSO Authentication Bypass
