On Monday, threat intelligence outfit Defused warned that attackers are actively exploiting three vulnerabilities in FortiSandbox: CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089. Two were disclosed in April. One of the public exploits, Defused notes, was clearly written by an LLM and is probably faulty. The other ones work fine. This is the cybersecurity story to pay attention to this week, and it’s not because of the bugs themselves.

FortiSandbox is the thing your other Fortinet boxes ask when they need a verdict on a file. NGFW, FortiMail, FortiWeb, they all subscribe to the sandbox’s reputation calls and use them to enforce blocking decisions. If the verdict machine is owned, every downstream choice your firewall makes is built on a lie. And that’s the thread that ties three otherwise unrelated stories together this week: trust delegation is the soft underbelly of modern defense in depth, and adversaries are walking right into it.

The Verdict Machine Now Has Three Live CVEs

Here’s the operational reality. CVE-2026-39813 is a path traversal in FortiSandbox. CVE-2026-39808 is a separate flaw disclosed alongside it in April. CVE-2026-25089 is the third in the active-exploitation bundle. The vibecoded PoC, machine-generated by an attacker with more access to a chatbot than to OPSEC, is faulty enough that Defused publicly described it as such. The other exploits in circulation, less so.

Most teams treat FortiSandbox as plumbing. It runs, it returns verdicts, it gets patched whenever the change window opens. That’s a mistake. The sandbox is a Tier 0 dependency: when it lies, your threat detection lies. An attacker who can flip a malicious verdict to clean has neutralized your perimeter without ever touching the perimeter device. An attacker who can read its config or pivot from it has a credentialed foothold inside the trust boundary.

If you run Fortinet’s stack, FortiSandbox is on the patch queue this week. If you can’t patch immediately, restrict management-plane access to a jump host, audit the box for unfamiliar files or scheduled jobs, and treat any recent file-verdict anomaly as suspicious until proven otherwise.

Bucket Squatting Owns The Vertex AI Supply Chain

Unit 42 published a separate piece this week on what they’re calling “Pickle in the Middle,” a cross-tenant RCE in Google’s Vertex AI Python SDK. The mechanic is bucket squatting: when a Google Cloud Storage bucket name gets freed up, an attacker registers it, and any tenant whose model upload code resolves to that name starts pushing weights into adversary-controlled storage. Pickle deserialization on the consumer side does the rest.

The trust delegation here is identical in shape to the FortiSandbox problem. The Vertex SDK trusts that a bucket name resolves to the same owner today as it did yesterday. The downstream ML pipeline trusts that whatever pickle file lands in that bucket is the model it asked for. Both assumptions held up fine until they didn’t, and the failure mode is silent cross-tenant code execution.

If your team trains or serves models through Vertex AI, this is incident response territory: enumerate bucket references baked into pipelines, pin them to project-scoped identifiers, and assume that any pickle-based model artifact pulled in the last 30 days is a candidate for tampering until you’ve verified the source.

Rokarolla Shows What Verdict Failure Looks Like On The Phone

Zimperium’s zLabs documented a new Android banking trojan called Rokarolla. It targets 217 banking and crypto apps. It ships with 137 remote commands. It reads and sends SMS, intercepts lock-screen PINs, rewrites the clipboard to redirect crypto sends, and switches off Google Play Protect on the way in. That last detail is the punchline.

Play Protect is the consumer-grade version of FortiSandbox. It’s the verdict service every other component of the Android security model assumes is on, returning truthful results. Rokarolla flips the switch off, then operates freely. There is no firewall to fail to, no second opinion to consult. The phone trusts that Play Protect is running. When it’s not, every downstream control collapses.

For BYOD environments, the practical defense is mobile threat-protection that runs orthogonal to the OS’s own verdicts, plus conditional access policies that gate sensitive corporate apps behind device posture checks the user can’t disable. If your access tier is “is this device managed and healthy,” and the healthy check trusts the device’s own self-report, you’ve outsourced your verdict to the attacker.

What To Actually Do This Week

The connective thread is concrete. Three of your trust delegations, one in your perimeter, one in your ML platform, one in your endpoint, just took live damage. None of these stories is solved by a better feed. They’re solved by treating the verdict-giver as the high-value target it actually is, and by building security hardening that doesn’t collapse when one verdict comes back wrong. Here’s the punch list:

• Patch FortiSandbox now, and put unfamiliar admin sessions or scheduled jobs on the sandbox itself on the threat detection radar. Treat the appliance like a domain controller, not a network widget.
• Inventory every Google Cloud Storage bucket referenced in your ML pipelines. Pin to project-scoped names, not bare bucket strings. Audit any pickle artifact downloaded in the last month.
• Tighten management-plane access on every security appliance. Jump hosts, allowlisted source IPs, and brute-force controls on the admin login. Tools like IPBan Pro on the management bastion close off password-spray attempts before they hit the appliance UI.
• Verify Play Protect or your MDM equivalent is enforced and reports back through a channel the device can’t silence. If posture trusts the device’s self-report, your conditional access is theatre.
• Add a verdict-failure scenario to your next incident response tabletop. What do you do for the 24 hours after you learn the sandbox was lying? Who decides which blocked files were actually clean, and which “clean” ones weren’t?

The cyber security mistake to avoid this week is treating any of these three stories as a one-off. They’re the same story. Defense in depth only works if each layer is willing to disagree with the one above it, and most of the stack isn’t built that way. The verdict service speaks, the firewall obeys, the endpoint trusts the OS to enforce its own controls. When the speaker lies, the listeners lie too.

Sources

• Attackers are exploiting FortiSandbox vulnerabilities (Help Net Security)
• Pickle in the Middle: Hijacking Vertex AI Model Uploads for Cross-Tenant RCE (Unit 42)
• New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds (The Hacker News)