CVE-2026-39813: FortiSandbox JRPC API Exploitation — Detection and Remediation Guide

Defused Cyber has issued a critical alert regarding the active exploitation of multiple security vulnerabilities in Fortinet FortiSandbox appliances. Over the past 24 hours, threat actors have been observed leveraging three distinct CVEs—CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089—against unpatched instances.

FortiSandbox is a critical component in many security architectures, responsible for detonating files to identify malware. A compromise of this platform allows attackers to subvert detection mechanisms, falsify analysis results, and potentially move laterally to the core network.

The Critical Vector: CVE-2026-39813

The most severe of the currently exploited flaws is CVE-2026-39813 (CVSS 9.1). This vulnerability is a path traversal issue affecting the FortiSandbox JRPC (Java Remote Procedure Call) API.

By sending specially crafted requests to the JRPC endpoint, an unauthenticated attacker can traverse the directory structure. Successful exploitation could allow the attacker to read sensitive files from the underlying operating system. In many appliance architectures, path traversal is a stepping stone to further exploitation, including Remote Code Execution (RCE), by reading configuration files, private keys, or application logic that exposes additional attack surfaces.

While technical details regarding CVE-2026-39808 and CVE-2026-25089 are still emerging, their simultaneous use in the wild suggests a coordinated campaign targeting these appliances, likely for initial access or credential harvesting.

Affected Products & Status

• Product: Fortinet FortiSandbox
• Vulnerabilities: CVE-2026-39813 (CVSS 9.1), CVE-2026-39808, CVE-2026-25089
• Exploitation Status: CONFIRMED ACTIVE (Defused Cyber, June 2026)
• Impact: Arbitrary file read via path traversal (CVE-2026-39813); potential system compromise.

Detection & Response

Given the active exploitation status, Security Arsenal consultants recommend the following detection logic. These rules focus on the anomalous usage of the JRPC API and potential post-exploitation activity on the appliance host.

SIGMA Rules

---
title: FortiSandbox JRPC Path Traversal Attempt
id: 8c4d2e1f-9a3b-4f5c-8d6e-1f2a3b4c5d6e
status: experimental
description: Detects potential path traversal attempts against the FortiSandbox JRPC API, indicative of CVE-2026-39813 exploitation.
references:
  - https://www.fortinet.com
  - Internal Threat Intel
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: fortinet
detection:
  selection:
    c-uri|contains:
      - '/rpc'
      - '/jrpc'
    cs-method: POST
    sc-status:
      - 200
      - 500
  filter_path_traversal:
    c-uri|contains:
      - '%2e%2e'
      - '../'
      - '..%5c'
  condition: selection and filter_path_traversal
falsepositives:
  - Unknown; legitimate JRPC traffic should not use directory traversal sequences.
level: critical
---
title: FortiSandbox Suspicious Process Execution
id: 9d5e3f2a-0b4c-5d6e-9e1f-2a3b4c5d6e7f
status: experimental
description: Detects suspicious shell or network tool execution spawned by FortiSandbox services, often a sign of post-exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/opt/fortisandbox/'
      - '/forti/'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/nc'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative debugging (rare).
level: high

Microsoft Sentinel / Defender KQL

// Hunt for anomalies in FortiSandbox logs (ingested via Syslog/CEF)
Syslog
| where Facility contains "Fortinet" 
| where SyslogMessage has_all ("rpc", "POST")
| project TimeGenerated, Computer, SourceIP, ProcessName, SyslogMessage
| extend PathTraversal = iif(SyslogMessage matches regex @"(%2e%2e|\.\./|..%5c)", "Potential Path Traversal", "Clean")
| where PathTraversal == "Potential Path Traversal"
| sort by TimeGenerated desc

Velociraptor VQL

-- Hunt for processes spawned by FortiSandbox binaries indicative of webshell activity
SELECT Pid, Name, Exe, CommandLine, ParentPid
FROM pslist()
WHERE Exe =~ '/opt/fortisandbox'
   OR Name =~ 'java'
   AND CommandLine =~ '(bash|sh|perl|python|curl|wget|nc)'

Remediation Script (Bash)

Note: This script performs a basic check on the running services and version. Definitive remediation requires applying the official patch from Fortinet Support.

#!/bin/bash
# FortiSandbox Emergency Check
# Author: Security Arsenal
# Date: 2026-06-10

echo "[*] Checking FortiSandbox service status..."
if systemctl is-active --quiet fortisandbox; then
    echo "[+] FortiSandbox service is running."
else
    echo "[-] FortiSandbox service is NOT running. Investigate immediately."
fi

echo "[*] Checking for recent modifications to JRPC config files..."
find /opt/fortisandbox -name "*.xml" -o -name "*.conf" -mtime -1 -ls

echo "[*] Reviewing active network connections for unusual outbound shells..."
netstat -antp | grep ESTABLISHED | grep -E '(4444|5555|6666)'

echo "[*] ACTION ITEM: Apply patch for CVE-2026-39813 immediately via Fortinet Support."

Remediation & Mitigation

1. Patch Immediately: Fortinet has released patches for these vulnerabilities. Verify the build version against the latest Fortinet PSIC Advisory. If your version is prior to the patched release released last week, schedule an emergency maintenance window immediately.
2. Restrict Management Access: Ensure the FortiSandbox management interface is not accessible from the internet. Place it behind a VPN or a bastion host with strict IP allow-listing.
3. Audit JRPC Usage: Review logs for any historical successful login or API calls to the JRPC endpoint from external IPs.
4. Credential Rotation: If exploitation is suspected, assume all credentials stored on the appliance (including API keys and AD integration credentials) are compromised. Rotate them immediately.

Official Resources

• Fortinet PSIC Advisory: [Link to Fortinet Customer Service / Support Portal]
• CISA Known Exploited Vulnerabilities Catalog (Check for inclusion)

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub