Hackers Attempt to Exploit Fortinet Sandbox Flaw, Possibly With AI Assistance

Fortinet's FortiSandbox analyzes suspicious files and programs in isolated environments and is deployed across enterprise, cloud and PaaS environments. CVE-2026-25089 is an operating system command-injection vulnerability that can be triggered without authentication through a specially crafted HTTP request and carries a CVSS score of 9.1. Successful exploitation could allow attackers to execute unauthorized commands, threatening corporate networks and malware-analysis defenses.

Threat intelligence firm Defused said on June 15, 2026, that it had observed hackers attempting to exploit CVE-2026-39813, CVE-2026-39808 and CVE-2026-25089 over the previous 24 hours. Fortinet released patches on April 14 and June 9. Defused assessed that the exploit code for CVE-2026-25089 may have been written with AI assistance, but the version seen at the time appeared to contain errors, and there was no evidence of a successful breach.