The Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Fortinet FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming they are being used in live attacks. The listing serves as an official government confirmation that these aren’t just theoretical risks sitting in a research paper; they’re actively being weaponized against real organizations.

Two Command Injection Flaws, One Shared Root Cause

The vulnerabilities, tracked as CVE-2026-39808 and CVE-2026-25089, both fall into the OS command injection category (classified under CWE-78). This class of bug arises when an application takes input supplied by a user or attacker and passes it along to the underlying operating system’s command interpreter without properly filtering or sanitizing it first. When that sanitization is missing, an attacker can smuggle their own commands inside what looks like ordinary input.

In practice, this means an unauthenticated attacker, someone with no valid login credentials whatsoever, can send a specially crafted HTTP request to a vulnerable FortiSandbox appliance and have it execute arbitrary operating system commands. No password guessing, no session hijacking, no social engineering required; just a malformed web request aimed at an exposed management interface.

Broader Reach Through Cloud and PaaS Deployments

CVE-2026-39808 affects on-premises FortiSandbox deployments directly. CVE-2026-25089 casts a wider net, reaching not just the standalone appliance but also FortiSandbox Cloud and FortiSandbox PaaS environments, meaning organizations that thought they’d offloaded this risk to a managed service are not automatically in the clear.

The stakes here are compounded by what FortiSandbox actually does. It’s a sandboxing tool organizations deploy specifically to detonate and analyze suspicious files, URLs, and malware samples in an isolated environment before they reach production systems. Because it routinely handles malicious content by design and is often wired into broader security tooling and alerting pipelines, a successful compromise doesn’t just expose one box, it can hand attackers a foothold with visibility into how an organization’s detection systems operate.

A Tight Deadline for Federal Agencies

CISA added both CVEs to the KEV catalog on July 16, 2026. Under Binding Operational Directive BOD 26-04, Federal Civilian Executive Branch agencies are required to apply vendor mitigations by July 19, 2026, giving them only a three-day window. That compressed timeline is itself a signal of how seriously the agency is treating the exposure: KEV deadlines are calibrated to the real-world risk of a flaw sitting unpatched and internet-facing.

While CISA has stopped short of confirming these specific bugs have been tied to ransomware deployments so far, the agency and independent researchers alike note that command injection flaws of this type are a favorite entry point for exactly that kind of follow-on activity. Once inside, attackers commonly use command execution primitives to drop web shells, harvest stored credentials, move laterally across a network, disable endpoint security tooling, or stage additional malware.

Recommended Response Steps

• Identify every internet-facing FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS asset in your environment as a first priority.
• Apply Fortinet’s available patches and mitigations without delay, and restrict management-interface access to trusted internal networks wherever possible.
• Review HTTP access logs for malformed or unusual requests targeting the appliance, and investigate any unexplained command executions or newly created administrative accounts.
• Follow CISA’s forensic triage guidance to determine whether a system was already compromised prior to patching, rather than assuming a clean patch retroactively resolves an existing intrusion.
• If a patch or mitigation isn’t yet available for your deployment type, CISA recommends following the relevant cloud provider’s guidance or, if necessary, temporarily discontinuing use of the affected product until remediation is possible.

Organizations running any flavor of FortiSandbox, whether on-premises, cloud, or PaaS, should treat this advisory as a same-week priority rather than folding it into a routine patch cycle. Security tools that are supposed to protect a network can become one of its biggest liabilities the moment they’re left exposed and unpatched.