CISA orders agencies to patch two exploited Fortinet FortiSandbox flaws

CISA has added two critical Fortinet FortiSandbox vulnerabilities to its exploited-vulnerabilities catalog and ordered federal agencies to patch them by July 19. Tracked as CVE-2026-39808 and CVE-2026-25089, both are operating-system command injection flaws that let an unauthenticated attacker run commands remotely with low complexity and no user interaction. Fortinet disclosed and fixed them in April and June, and threat intelligence firm Defused reported in-the-wild abuse of FortiSandbox flaws in June. FortiSandbox is a threat-detection appliance, and Fortinet gear sits at many network edges, so these devices are a recurring target in espionage and ransomware campaigns, making prompt patching important.

Check

Identify Fortinet FortiSandbox appliances in your environment, check their versions against Fortinet's advisories for these flaws, and upgrade to the fixed releases, prioritizing any internet-reachable or edge-facing devices.

Affected

Organizations running affected Fortinet FortiSandbox versions (CVE-2026-39808, CVE-2026-25089); unauthenticated attackers can run commands remotely, and active exploitation of FortiSandbox flaws has been reported, making unpatched appliances a real risk.

Fix

Upgrade FortiSandbox to the fixed versions, such as 4.4.9 for the April flaw, restrict and monitor management access to these appliances, and review logs and configurations for unauthorized commands or changes.