CISA Orders Patching for Critical FortiSandbox Vulnerabilities Under Active Exploitation
Two critical flaws in FortiSandbox products added to Known Exploited Vulnerabilities catalog with mandatory patching.
1Critical Security Vulnerabilities Identified
Two critical vulnerabilities (CVE-2026-39808 and CVE-2026-25089) with CVSS 9.1 scores were found in FortiSandbox products. These unauthenticated OS command injection flaws allow remote code execution via crafted HTTP requests.
2Evidence of Active Exploitation
CISA confirmed active exploitation by adding these flaws to its Known Exploited Vulnerabilities catalog. Federal agencies must patch immediately under Binding Operational Directive 26-04 or disconnect affected systems.
3Fortinet's Patches and Warnings
Fortinet released patches in April and June 2026, warning that low-complexity attacks could lead to remote code execution. The company hasn't updated its advisories despite CISA's exploitation confirmation.
4Industry Observations
Security firm Defused reported exploitation attempts against both vulnerabilities this week. Attempts targeting CVE-2026-25089 appeared broken, with no working public exploit observed yet.
5Critical SharePoint Warning
CISA also flagged Microsoft's SharePoint Server vulnerability (CVE-2026-58644) in the same update. This critical 9.8-rated flaw allows authenticated attackers with Site Owner privileges to execute remote code.
6Urgent Action Required
Experts urge immediate patching, especially for government agencies and critical infrastructure operators. Internet-exposed systems face particularly high risk from these easily exploitable vulnerabilities.