Critical RCE Vulnerabilities Hit FortiSandbox and FortiAuthenticator: Patch Now

Two Critical Fortinet RCEs Land at the Same Time — That's Not a Coincidence You Can Ignore

Fortinet dropping simultaneous critical patches for two distinct products in its security stack is the kind of advisory that should immediately escalate to your on-call queue, not your next sprint backlog. The affected products — FortiSandbox and FortiAuthenticator — sit in positions that make exploitation particularly damaging.

Why These Specific Products Matter

FortiAuthenticator is your authentication broker. It handles MFA, RADIUS, LDAP integration, and certificate management for a significant chunk of Fortinet-heavy environments. A remote code execution flaw here isn't just a box compromise — it's a potential pivot into every identity workflow that product touches. If an attacker can run arbitrary commands on your FortiAuthenticator instance, they're not just on a server; they're adjacent to your credential issuance pipeline.

FortiSandbox is the product you're running specifically to detonate and analyze suspicious content. The irony of a sandbox solution carrying its own RCE vulnerability is not lost on us — and attackers will absolutely appreciate the positioning. Compromising a sandbox appliance could allow an adversary to manipulate verdicts, exfiltrate samples, or use the box as a beachhead into a network segment that was presumably isolated for good reason.

What We Know About the Vulnerabilities

Fortinet has confirmed these are critical-severity flaws enabling remote code execution or arbitrary command execution. The specific technical mechanism and CVE identifiers are part of the official advisory — details beyond that characterization have not been made fully public at the time of writing, which is typical for Fortinet's initial disclosure cadence. We'll update as the technical specifics surface.

What we can say: "critical RCE" in Fortinet's own classification language means CVSS scores in the 9.x range. These are not theoretical edge cases requiring physical access or chained prerequisites to exploit.

Operator Checklist

Right now:

• Pull your FortiSandbox and FortiAuthenticator version inventory. If you're running these products and don't know what version you're on, that's the first problem to solve.
• Check Fortinet's advisory for the specific affected version ranges and patched releases.
• If you cannot patch immediately, assess whether these management interfaces are exposed to untrusted networks. They shouldn't be, but verify — don't assume.

After patching:

• Review authentication logs on FortiAuthenticator for anomalous service account activity or unexpected certificate issuance in the window before you patched.
• Check FortiSandbox for any unexpected outbound connections or configuration changes.
• If either system is internet-facing (it really shouldn't be), treat the pre-patch window as a potential compromise period and scope an investigation accordingly.

The Broader Pattern

This is the third time in recent memory that Fortinet has had to push emergency patches for critical vulnerabilities in network security and identity infrastructure products. We're not piling on — every major vendor in this space has had rough quarters — but if you're a CISO or security architect with significant Fortinet footprint, the recurring pattern here should be informing your patching SLA conversations. "Critical Fortinet patch" can no longer be treated as a rare event requiring special handling; it needs a standing runbook.

Fortinet's communication on these issues has generally been timely, which we credit them for. The problem is operational tempo: patching FortiAuthenticator in a production environment with dependencies on RADIUS and MFA flows requires coordination that takes time you may not have if exploitation is already underway in the wild.

Patch velocity on this one matters. Don't let change management process become the vulnerability.

Full details, affected versions, and patch downloads are available in the original BleepingComputer report: Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator