{"id":1650,"date":"2026-06-17T07:19:28","date_gmt":"2026-06-17T00:19:28","guid":{"rendered":"https:\/\/vncybers.vn\/fortinet-fortisandbox-bi-khai-thac-qua-ba-lo-hong-nghiem-trong-quan-tri-vien-can-cap-nhat-khan-cap\/"},"modified":"2026-06-20T08:11:23","modified_gmt":"2026-06-20T01:11:23","slug":"fortinet-fortisandbox-bi-khai-thac-qua-ba-lo-hong-nghiem-trong-quan-tri-vien-can-cap-nhat-khan-cap","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/fortinet-fortisandbox-bi-khai-thac-qua-ba-lo-hong-nghiem-trong-quan-tri-vien-can-cap-nhat-khan-cap\/","title":{"rendered":"Fortinet FortiSandbox b\u1ecb khai th\u00e1c qua ba l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng, qu\u1ea3n tr\u1ecb vi\u00ean c\u1ea7n c\u1eadp nh\u1eadt kh\u1ea9n c\u1ea5p"},"content":{"rendered":"

Fortinet FortiSandbox, n\u1ec1n t\u1ea3ng ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c v\u00e0 ph\u00e1t hi\u1ec7n m\u1ed1i \u0111e d\u1ecda trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p, \u0111ang tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau khai th\u00e1c c\u1ee7a tin t\u1eb7c th\u00f4ng qua nhi\u1ec1u l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng. Theo BleepingComputer v\u00e0 The Hacker News, ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c \u0111\u00e3 \u0111\u01b0\u1ee3c ghi nh\u1eadn \u0111\u1ed1i v\u1edbi ba l\u1ed7 h\u1ed5ng CVE-2026-39813, CVE-2026-39808 v\u00e0 CVE-2026-25089.<\/p>\n

\u0110\u00e2y l\u00e0 nh\u00f3m l\u1ed7 h\u1ed5ng \u0111\u00e1ng ch\u00fa \u00fd v\u00ec \u1ea3nh h\u01b0\u1edfng tr\u1ef1c ti\u1ebfp \u0111\u1ebfn m\u1ed9t s\u1ea3n ph\u1ea9m b\u1ea3o m\u1eadt n\u1eb1m trong l\u1edbp ph\u00f2ng th\u1ee7 c\u1ee7a t\u1ed5 ch\u1ee9c. Khi thi\u1ebft b\u1ecb b\u1ea3o m\u1eadt b\u1ecb khai th\u00e1c, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 bi\u1ebfn ch\u00ednh \u0111i\u1ec3m ki\u1ec3m so\u00e1t an ninh th\u00e0nh b\u00e0n \u0111\u1ea1p \u0111\u1ec3 m\u1edf r\u1ed9ng hi\u1ec7n di\u1ec7n trong m\u1ea1ng n\u1ed9i b\u1ed9.<\/p>\n

\"Trung<\/p>\n

Ba l\u1ed7 h\u1ed5ng \u0111ang \u0111\u01b0\u1ee3c nh\u1eafc \u0111\u1ebfn l\u00e0 g\u00ec?<\/h2>\n

C\u00e1c b\u00e1o c\u00e1o c\u00f4ng khai cho bi\u1ebft CVE-2026-39813 l\u00e0 l\u1ed7 h\u1ed5ng path traversal trong FortiSandbox JRPC API, c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng ch\u01b0a x\u00e1c th\u1ef1c v\u01b0\u1ee3t qua c\u01a1 ch\u1ebf x\u00e1c th\u1ef1c b\u1eb1ng y\u00eau c\u1ea7u HTTP \u0111\u01b0\u1ee3c ch\u1ebf t\u00e1c \u0111\u1eb7c bi\u1ec7t. CVE-2026-39808 l\u00e0 l\u1ed7 h\u1ed5ng command injection, c\u0169ng c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c t\u1eeb xa m\u00e0 kh\u00f4ng c\u1ea7n t\u01b0\u01a1ng t\u00e1c ng\u01b0\u1eddi d\u00f9ng.<\/p>\n

L\u1ed7 h\u1ed5ng th\u1ee9 ba, CVE-2026-25089, li\u00ean quan \u0111\u1ebfn command injection tr\u00ean FortiSandbox, FortiSandbox Cloud v\u00e0 FortiSandbox PaaS WEB UI. Fortinet \u0111\u00e3 ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 cho hai l\u1ed7 h\u1ed5ng \u0111\u1ea7u v\u00e0o th\u00e1ng 4\/2026, trong khi CVE-2026-25089 \u0111\u01b0\u1ee3c v\u00e1 g\u1ea7n \u0111\u00e2y h\u01a1n. \u0110i\u1ec3m chung \u0111\u00e1ng lo ng\u1ea1i l\u00e0 c\u1ea3 ba \u0111\u1ec1u c\u00f3 m\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng cao v\u00e0 c\u00f3 th\u1ec3 m\u1edf \u0111\u01b0\u1eddng cho th\u1ef1c thi l\u1ec7nh tr\u00e1i ph\u00e9p.<\/p>\n

V\u00ec sao v\u1ee5 vi\u1ec7c \u0111\u00e1ng ch\u00fa \u00fd?<\/h2>\n

FortiSandbox th\u01b0\u1eddng \u0111\u01b0\u1ee3c tri\u1ec3n khai \u0111\u1ec3 ph\u00e2n t\u00edch t\u1ec7p nghi v\u1ea5n, ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c, h\u1ed7 tr\u1ee3 \u0111i\u1ec1u tra s\u1ef1 c\u1ed1 v\u00e0 b\u1ed5 sung l\u1edbp b\u1ea3o v\u1ec7 cho email, web ho\u1eb7c endpoint. N\u1ebfu n\u1ec1n t\u1ea3ng n\u00e0y b\u1ecb chi\u1ebfm quy\u1ec1n, h\u1eadu qu\u1ea3 kh\u00f4ng ch\u1ec9 d\u1eebng \u1edf m\u1ed9t m\u00e1y ch\u1ee7 \u0111\u01a1n l\u1ebb m\u00e0 c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn quy tr\u00ecnh gi\u00e1m s\u00e1t an ninh c\u1ee7a to\u00e0n t\u1ed5 ch\u1ee9c.<\/p>\n

Theo BleepingComputer, Defused Cyber cho bi\u1ebft \u0111\u00e3 quan s\u00e1t ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c nhi\u1ec1u l\u1ed7 h\u1ed5ng FortiSandbox trong v\u00f2ng 24 gi\u1edd. The Hacker News c\u0169ng ghi nh\u1eadn chi ti\u1ebft r\u1eb1ng CVE-2026-39813 v\u00e0 CVE-2026-39808 c\u00f3 \u0111i\u1ec3m CVSS 9.1, c\u00f2n CVE-2026-25089 c\u0169ng \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 \u1edf m\u1ee9c 9.1. V\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng \u0111ang ph\u01a1i l\u1ed9 tr\u00ean Internet ho\u1eb7c ch\u01b0a \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt, c\u1eeda s\u1ed5 r\u1ee7i ro v\u00ec v\u1eady r\u1ea5t ng\u1eafn.<\/p>\n

T\u00e1c \u0111\u1ed9ng \u0111\u1ed1i v\u1edbi doanh nghi\u1ec7p<\/h2>\n

Trong th\u1ef1c t\u1ebf v\u1eadn h\u00e0nh, c\u00e1c thi\u1ebft b\u1ecb b\u1ea3o m\u1eadt th\u01b0\u1eddng \u0111\u01b0\u1ee3c c\u1ea5p quy\u1ec1n cao, k\u1ebft n\u1ed1i \u0111\u1ebfn nhi\u1ec1u v\u00f9ng m\u1ea1ng v\u00e0 x\u1eed l\u00fd d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m. M\u1ed9t l\u1ed7 h\u1ed5ng command injection ho\u1eb7c b\u1ecf qua x\u00e1c th\u1ef1c tr\u00ean nh\u00f3m thi\u1ebft b\u1ecb n\u00e0y c\u00f3 th\u1ec3 t\u1ea1o ra r\u1ee7i ro leo thang \u0111\u1eb7c quy\u1ec1n, \u0111\u00e1nh c\u1eafp th\u00f4ng tin c\u1ea5u h\u00ecnh, c\u00e0i m\u00e3 \u0111\u1ed9c ho\u1eb7c t\u1ea1o foothold \u0111\u1ec3 di chuy\u1ec3n ngang.<\/p>\n

Fortinet l\u00e0 th\u01b0\u01a1ng hi\u1ec7u th\u01b0\u1eddng xuy\u00ean xu\u1ea5t hi\u1ec7n trong c\u00e1c chi\u1ebfn d\u1ecbch khai th\u00e1c thi\u1ebft b\u1ecb bi\u00ean v\u00e0 thi\u1ebft b\u1ecb b\u1ea3o m\u1eadt. \u0110i\u1ec1u n\u00e0y kh\u00f4ng nh\u1ea5t thi\u1ebft ph\u1ea3n \u00e1nh ri\u00eang ch\u1ea5t l\u01b0\u1ee3ng c\u1ee7a m\u1ed9t s\u1ea3n ph\u1ea9m, m\u00e0 cho th\u1ea5y c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng lu\u00f4n \u01b0u ti\u00ean m\u1ee5c ti\u00eau c\u00f3 quy\u1ec1n truy c\u1eadp s\u00e2u, \u0111\u01b0\u1ee3c tri\u1ec3n khai r\u1ed9ng v\u00e0 th\u01b0\u1eddng kh\u00f3 ng\u1eaft d\u1ecbch v\u1ee5 \u0111\u1ec3 b\u1ea3o tr\u00ec.<\/p>\n

Recommendations for Administrators<\/h2>\n

Qu\u1ea3n tr\u1ecb vi\u00ean c\u1ea7n ki\u1ec3m tra ngay phi\u00ean b\u1ea3n FortiSandbox, FortiSandbox Cloud ho\u1eb7c FortiSandbox PaaS \u0111ang s\u1eed d\u1ee5ng v\u00e0 \u0111\u1ed1i chi\u1ebfu v\u1edbi khuy\u1ebfn c\u00e1o m\u1edbi nh\u1ea5t t\u1eeb Fortinet. V\u1edbi h\u1ec7 th\u1ed1ng t\u1ef1 qu\u1ea3n l\u00fd, c\u1ea7n \u01b0u ti\u00ean c\u1eadp nh\u1eadt l\u00ean b\u1ea3n v\u00e1 m\u1edbi nh\u1ea5t, h\u1ea1n ch\u1ebf truy c\u1eadp giao di\u1ec7n qu\u1ea3n tr\u1ecb t\u1eeb Internet, r\u00e0 so\u00e1t nh\u1eadt k\u00fd HTTP b\u1ea5t th\u01b0\u1eddng v\u00e0 ki\u1ec3m tra d\u1ea5u hi\u1ec7u th\u1ef1c thi l\u1ec7nh tr\u00e1i ph\u00e9p.<\/p>\n

Ngo\u00e0i c\u1eadp nh\u1eadt ph\u1ea7n m\u1ec1m, t\u1ed5 ch\u1ee9c n\u00ean \u0111\u01b0a FortiSandbox v\u00e0o danh s\u00e1ch t\u00e0i s\u1ea3n c\u1ea7n gi\u00e1m s\u00e1t \u0111\u1eb7c bi\u1ec7t, bao g\u1ed3m ki\u1ec3m tra c\u1ea5u h\u00ecnh x\u00e1c th\u1ef1c, ph\u00e2n quy\u1ec1n t\u00e0i kho\u1ea3n, k\u1ebft n\u1ed1i m\u1ea1ng \u0111i ra ngo\u00e0i v\u00e0 t\u00edch h\u1ee3p c\u1ea3nh b\u00e1o v\u1edbi SIEM. C\u00e1c b\u1ea3n ghi trong giai \u0111o\u1ea1n tr\u01b0\u1edbc khi v\u00e1 c\u0169ng c\u1ea7n \u0111\u01b0\u1ee3c gi\u1eef l\u1ea1i \u0111\u1ec3 ph\u1ee5c v\u1ee5 \u0111i\u1ec1u tra n\u1ebfu ph\u00e1t hi\u1ec7n d\u1ea5u hi\u1ec7u x\u00e2m nh\u1eadp.<\/p>\n

B\u00e0i h\u1ecdc r\u1ed9ng h\u01a1n<\/h2>\n

V\u1ee5 vi\u1ec7c FortiSandbox nh\u1eafc l\u1ea1i m\u1ed9t nguy\u00ean t\u1eafc quan tr\u1ecdng: thi\u1ebft b\u1ecb b\u1ea3o m\u1eadt kh\u00f4ng n\u00ean \u0111\u01b0\u1ee3c m\u1eb7c \u0111\u1ecbnh l\u00e0 an to\u00e0n tuy\u1ec7t \u0111\u1ed1i ch\u1ec9 v\u00ec ch\u1ee9c n\u0103ng c\u1ee7a n\u00f3 l\u00e0 b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng. Trong ki\u1ebfn tr\u00fac hi\u1ec7n \u0111\u1ea1i, m\u1ecdi th\u00e0nh ph\u1ea7n c\u00f3 giao di\u1ec7n qu\u1ea3n tr\u1ecb, API ho\u1eb7c kh\u1ea3 n\u0103ng th\u1ef1c thi l\u1ec7nh \u0111\u1ec1u c\u1ea7n \u0111\u01b0\u1ee3c v\u00e1 nhanh, ph\u00e2n v\u00f9ng m\u1ea1ng r\u00f5 r\u00e0ng v\u00e0 gi\u00e1m s\u00e1t nh\u01b0 m\u1ed9t t\u00e0i s\u1ea3n r\u1ee7i ro cao.<\/p>\n

\u0110\u1ed1i v\u1edbi doanh nghi\u1ec7p Vi\u1ec7t Nam, \u0111\u1eb7c bi\u1ec7t l\u00e0 c\u00e1c \u0111\u01a1n v\u1ecb s\u1eed d\u1ee5ng thi\u1ebft b\u1ecb b\u1ea3o m\u1eadt \u1edf l\u1edbp bi\u00ean ho\u1eb7c trung t\u00e2m d\u1eef li\u1ec7u, \u01b0u ti\u00ean hi\u1ec7n t\u1ea1i l\u00e0 ki\u1ec3m k\u00ea phi\u00ean b\u1ea3n, x\u00e1c minh tr\u1ea1ng th\u00e1i v\u00e1 v\u00e0 r\u00e0 so\u00e1t quy\u1ec1n truy c\u1eadp qu\u1ea3n tr\u1ecb. Vi\u1ec7c ch\u1eadm c\u1eadp nh\u1eadt trong v\u00e0i ng\u00e0y c\u00f3 th\u1ec3 \u0111\u1ee7 \u0111\u1ec3 bi\u1ebfn m\u1ed9t l\u1ed7 h\u1ed5ng \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 th\u00e0nh s\u1ef1 c\u1ed1 x\u00e2m nh\u1eadp th\u1ef1c t\u1ebf.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer, The Hacker News v\u00e0 khuy\u1ebfn c\u00e1o b\u1ea3o m\u1eadt Fortinet<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Fortinet FortiSandbox, n\u1ec1n t\u1ea3ng ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c v\u00e0 ph\u00e1t hi\u1ec7n m\u1ed1i \u0111e d\u1ecda trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p, \u0111ang tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau khai th\u00e1c c\u1ee7a tin t\u1eb7c th\u00f4ng qua nhi\u1ec1u l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng. Theo BleepingComputer v\u00e0 The Hacker News, ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c \u0111\u00e3 \u0111\u01b0\u1ee3c ghi nh\u1eadn \u0111\u1ed1i v\u1edbi ba l\u1ed7 h\u1ed5ng […]<\/p>\n","protected":false},"author":2,"featured_media":1648,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[193,192,191,190,188,189,194],"class_list":["post-1650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-command-injection","tag-cve-2026-25089","tag-cve-2026-39808","tag-cve-2026-39813","tag-fortinet","tag-fortisandbox","tag-threat-intelligence"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1650"}],"version-history":[{"count":1,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1650\/revisions"}],"predecessor-version":[{"id":1660,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1650\/revisions\/1660"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1648"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}