CISA’s Known Exploited Vulnerabilities catalog just put two FortiSandbox command injection flaws on an emergency clock. For federal civilian agencies, the due date is July 19, 2026. For everyone else, that deadline is still a useful signal: if FortiSandbox is reachable, integrated into security workflows, or exposed through a management path, treat this as active incident-prevention work rather than a normal patch cycle.

The vulnerabilities are CVE-2026-39808 and CVE-2026-25089. Both are OS command injection issues affecting FortiSandbox products, and both can allow an unauthenticated attacker to execute unauthorized commands through crafted HTTP requests. Fortinet published fixes earlier this year, but CISA’s KEV addition indicates there is enough exploitation evidence to move these from “important advisory” to “known exploited risk.”

Why FortiSandbox matters

Sandboxing systems often sit in a trusted position. They receive suspicious files, detonate payloads, integrate with email and web security tools, and may have connectivity into logging, SIEM, SOAR, and incident response workflows. That makes compromise especially painful: an attacker is not just landing on another appliance; they may be landing on a security control that defenders already trust.

For small businesses, MSPs, and government contractors, the key concern is not only whether the FortiSandbox console is public-facing. It is whether the appliance is reachable from semi-trusted networks, old VPN segments, partner paths, management jump boxes, or security automation systems that attackers could reach after initial access.

What changed

  • CISA added both FortiSandbox flaws to KEV on July 16, 2026, with a July 19 federal remediation deadline.
  • Fortinet’s advisories identify the issue class as CWE-78 OS command injection, with unauthenticated exploitation possible through crafted HTTP requests.
  • The Register reported that researchers observed exploitation attempts, including activity against these FortiSandbox bugs and another related FortiSandbox vulnerability.
  • The practical defensive priority is exposure reduction plus patch verification, not waiting for public exploit maturity or vendor exploit-confirmation language.

Defensive takeaways

  • Patch or isolate immediately. Upgrade affected FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS versions according to Fortinet’s advisories. If patching cannot happen quickly, remove external and unnecessary internal reachability until it can.
  • Verify actual exposure. Check firewall rules, VPN access groups, jump-host paths, NAT rules, reverse proxies, security tooling integrations, and management networks. Do not assume “not internet-facing” means “not reachable by an attacker.”
  • Review appliance and upstream logs. Look for unusual HTTP requests, unexpected command execution indicators, new files, modified scripts, suspicious outbound connections, and authentication or session anomalies around the FortiSandbox management interface.
  • Hunt from the appliance outward. If compromise is suspected, review where FortiSandbox can authenticate, export logs, retrieve samples, send alerts, or interact with other security tools. A trusted security appliance can become a pivot point.
  • Treat security infrastructure as Tier 0-adjacent. EDR consoles, sandboxes, SIEM collectors, SOAR platforms, VPNs, firewalls, and identity systems deserve tighter admin access, segmentation, backups, and monitoring than ordinary application servers.

Bulwark Black assessment

This is another reminder that edge and security appliances are now primary targets. Attackers are not only looking for desktops and servers; they are looking for systems with trusted network placement, privileged integrations, and weaker operational monitoring. FortiSandbox should be handled like any other high-impact security control: inventory it, reduce reachability, patch fast, preserve logs, and validate whether exploitation occurred before declaring the work complete.

Sources: The Register reporting on FortiSandbox exploitation and CISA KEV action; CISA Known Exploited Vulnerabilities catalog; Fortinet PSIRT advisories FG-IR-26-100 and FG-IR-26-141.