Attackers Hit Pair of Critical Fortinet Vulnerabilities the Vendor Disclosed in April

Critical vulnerabilities in Fortinet's FortiSandbox have moved from disclosed-but-unpatched risk to actively exploited threat, according to multiple incident response and threat intelligence firms. The flaws, which Fortinet disclosed in April 2026, are now being targeted in attacks that appear to originate from several distinct threat actors rather than a single coordinated campaign.

What Was Disclosed in April

In April 2026, Fortinet published advisories for critical-severity remote code execution vulnerabilities affecting FortiSandbox — the company's cloud sandboxing product used by organisations to detonate and analyse suspicious files in an isolated environment.

FortiSandbox is commonly deployed at the perimeter of enterprise networks as part of advanced threat protection stacks. Because the product receives and executes potentially malicious content by design, it requires careful hardening and prompt patching; a vulnerability in a sandboxing product is particularly ironic since the attacker can use the analysis system itself as the attack surface.

The disclosed vulnerabilities included flaws rated with high CVSS scores, with at least one at critical severity. Fortinet issued patches in April and recommended immediate upgrading, noting that the vulnerabilities could be exploited without authentication under certain conditions.

Active Exploitation Confirmed

Approximately two months after the initial disclosure, multiple firms — including CrowdStrike, Mandiant, and others in the threat intelligence space — have now confirmed they are observing exploitation attempts and successful compromises of unpatched FortiSandbox instances in the wild.

Notably, the exploitation is not attributed to a single actor. Researchers warn that the attacks "originate from multiple sources," indicating that:

• The vulnerability details have been widely reverse-engineered from Fortinet's patches
• Proof-of-concept exploit code is likely circulating in underground forums
• Both financially motivated threat actors and suspected nation-state groups may be opportunistically scanning for unpatched systems

This multi-actor exploitation pattern is typical of Fortinet vulnerability disclosure cycles. The vendor's products — FortiGate firewalls, FortiClient, FortiOS, and FortiSandbox — are ubiquitous in enterprise environments globally, making any disclosed critical flaw an immediate target for opportunistic scanning within weeks of publication.

Why FortiSandbox Is a High-Value Target

From an attacker's perspective, a compromised FortiSandbox provides:

1. Access to a trusted network segment — sandbox products typically sit on well-connected internal segments to facilitate traffic inspection
2. Visibility into what files and traffic are being analysed — intelligence about what the organisation is suspicious of
3. Potential access to sensitive submitted samples — malware analysts sometimes submit internal files to sandbox for review
4. Pivot capability — a foothold in the security infrastructure is a foothold in the network

For ransomware operators, taking out or bypassing the sandbox before detonating a payload could also reduce the chance of detection during the attack itself.

Which Organisations Are at Risk

Organisations running FortiSandbox versions that have not been updated since before the April 2026 patches are at immediate risk. The product is commonly deployed by:

• Enterprise security operations centres (SOCs)
• Managed security service providers (MSSPs)
• Financial institutions
• Government and defence contractors
• Healthcare networks

Given Fortinet's broad installed base, the number of exposed instances at the time of initial disclosure was substantial. The transition to active exploitation means the window for unpressured patching has closed.

Recommended Actions

Immediate (within 24 hours):

1. Identify all FortiSandbox instances in your environment and confirm running firmware versions
2. Cross-reference against Fortinet's April 2026 advisory to determine if the patch has been applied
3. If unpatched, apply the fix immediately or take the appliance offline if patching cannot be done immediately

Short-term:

4. Review FortiSandbox access logs for anomalous activity, particularly unusual outbound connections, failed authentication attempts, or unexpected process execution
5. Restrict management interface access to known administrative IP ranges if not already enforced
6. Engage your SOC to hunt for indicators of compromise consistent with FortiSandbox exploitation

Ongoing:

7. Enroll in Fortinet's security advisory mailing list and treat critical advisories as requiring patch deployment within 72 hours
8. Conduct a broader audit of Fortinet products in your environment — this vendor has a pattern of critical vulnerabilities that attract rapid exploitation

Fortinet's Pattern and Industry Expectations

This incident continues a recurring pattern: Fortinet discloses critical vulnerabilities, a significant proportion of the installed base does not patch within the remediation window, and active exploitation follows. The pattern is not unique to Fortinet — it affects virtually every vendor with wide enterprise deployment — but the severity and frequency of exploited Fortinet vulnerabilities has been a consistent feature of threat landscape reports from 2024 through 2026.

CISA's Known Exploited Vulnerabilities (KEV) catalog has listed multiple Fortinet flaws in recent years, requiring federal agencies to patch within defined windows. The FortiSandbox vulnerabilities are expected to appear on the KEV following confirmed exploitation reports.

For security teams, the message is the same as it has always been: the time to patch Fortinet products is immediately upon advisory publication, not when exploitation is confirmed.