# CISA Orders Patching for Critical FortiSandbox Vulnerabilities Under Active Exploitation Two critical flaws in FortiSandbox products added to Known Exploited Vulnerabilities catalog with mandatory patching. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-17 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/239e8ad0-2971-4700-9fb4-29d11d18018c ## Critical Security Vulnerabilities Identified Two critical vulnerabilities (CVE-2026-39808 and CVE-2026-25089) with CVSS 9.1 scores were found in FortiSandbox products. These unauthenticated OS command injection flaws allow remote code execution via crafted HTTP requests. ## Evidence of Active Exploitation CISA confirmed active exploitation by adding these flaws to its Known Exploited Vulnerabilities catalog. Federal agencies must patch immediately under Binding Operational Directive 26-04 or disconnect affected systems. ## Fortinet's Patches and Warnings Fortinet released patches in April and June 2026, warning that low-complexity attacks could lead to remote code execution. The company hasn't updated its advisories despite CISA's exploitation confirmation. ## Industry Observations Security firm Defused reported exploitation attempts against both vulnerabilities this week. Attempts targeting CVE-2026-25089 appeared broken, with no working public exploit observed yet. ## Critical SharePoint Warning CISA also flagged Microsoft's SharePoint Server vulnerability (CVE-2026-58644) in the same update. This critical 9.8-rated flaw allows authenticated attackers with Site Owner privileges to execute remote code. ## Urgent Action Required Experts urge immediate patching, especially for government agencies and critical infrastructure operators. Internet-exposed systems face particularly high risk from these easily exploitable vulnerabilities. ## Sources covering this story - https://www.theregister.com/security/2026/07/17/attackers-target-critical-fortisandbox-flaws-as-cisa-issues-patch-order/5274287 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._